auditing-mcp-servers-for-tool-poisoning

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to print raw tool descriptions and to display SSRF/tool responses (e.g., printing res.content and unverified descriptions), which can cause the model to output secret values (tokens, keys, file contents) verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). In scripts/agent.py mode enum, the agent launches an outsider-provided MCP server (--command/--args), calls session.list_tools(), and then ingests the server’s tool description strings into the agent’s own LLM-relevant output/processing (heuristic scanning), which is indirect prompt injection via tool descriptions.