mastra

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The "Companion check" directs the agent to run local shell commands (ls ~/.claude/..., etc.) and suggest running npx to install skills — actions that access/modify the host environment and are not part of the Mastra framework's stated purpose, so they are hidden/out-of-scope instructions and constitute a prompt injection.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). This skill includes runtime examples that fetch and ingest public third-party content—e.g., the weather tool's execute uses fetch('https://wttr.in/...') and the MCPClient examples connect to external SSE URLs (references/mcp-and-voice.md) with agent tools populated via mcp.listTools()/mcp.listToolsets(), meaning untrusted remote content (tool definitions or fetched responses) is read and can influence agent behavior and tool selection.