agents-connect

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill includes multiple CLI examples that place API keys and client secrets directly in command arguments (e.g., --api-key sk-..., --oauth-client-secret your-client-secret) which encourages the LLM to emit secret values verbatim and thus creates an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill’s required runtime workflow includes discoverable tools from an MCP server opened via session.list_tools() / client.get_tools() (Path A), where the MCP server is an outsider source and its returned tool descriptions/fields are ingested into the agent/LLM tool context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's runtime code fetches tool definitions from a gateway URL (via the AGENTCORE_GATEWAY_MYGATEWAY_URL env var) and also contains a direct API call to "https://api.example.com/endpoint", so external URLs are used at runtime to supply tools that control agent behavior and to execute remote API calls (examples: https://mcp.example.com/mcp and https://api.example.com/endpoint).