mcp-client-integration

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The skill’s runtime workflow is about configuring/connecting to MCP servers (e.g., HTTP/SSE via a provided URL or stdio via npx), which can cause the agent to ingest outsider-authored free text from those external servers’ tool outputs and/or fetched content; the provided SKILL.md itself is only documentation and not the runtime ingestion path.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill spawns remote packages with npx (e.g., "npx -y @modelcontextprotocol/server-github") and also connects at runtime to external MCP endpoints that supply tool schemas (e.g., https://mcp.linear.app/sse and https://mcp.example.com), meaning remote code is executed and remote content can directly control agent prompts/instructions.