auditing-mcp-servers-for-tool-poisoning

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly instructs printing raw tool descriptions and SSRF probe responses (including IMDS and file:/// targets) and to include those outputs as evidence in reports, which requires the agent/LLM to handle and emit secret values verbatim.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). One high-risk item: a direct shell installer (https://astral.sh/uv/install.sh) is referenced (curl | sh), which is a risky direct-install pattern from a third-party domain and can be abused to distribute malware.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/agent.py, the enum mode launches an outsider-supplied stdio MCP server (StdioServerParameters(command=args.command, args=args.args)) and ingests its tool t.description via session.list_tools() for heuristic scanning, so tool descriptions from a malicious third party can inject instructions into the agent’s runtime context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs users to run a remote install script via "curl -LsSf https://astral.sh/uv/install.sh | sh", which fetches and immediately executes remote code (used as the recommended runtime installer for uv/uvx), so this URL is a high-confidence runtime fetch-and-execute dependency.