endpoint-probe

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill's examples and CLI flags (e.g., --auth, --header, --mcp-env) show and expect API tokens/keys to be passed verbatim on the command line or embedded in headers/env, which would require the LLM to include secret values exactly in generated commands or code.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow for endpoint-probe ingests outsider-authored free text at runtime by HTTP POSTing GraphQL introspection queries and reading/processing response bodies from user-supplied base_url/--mcp endpoints (and similarly for OpenAPI/Swagger JSON), which can contain arbitrary attacker-controlled text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The probe contacts user-supplied MCP HTTP endpoints at runtime and will POST JSON-RPC to endpoints such as https://mcp.example.com/mcp to retrieve tools, resources, and prompt templates that can directly control agent prompts/behavior.