add-tavily-tool

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow registers the Tavily MCP server (mcp__tavily__tavily_search / mcp__tavily__tavily_extract) via ncl groups config add-mcp-server, and at runtime the agent will ingest free-form text returned from Tavily’s web-crawled content—which is attacker-authored—when performing search/extract.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill registers and points the runtime MCP bridge at https://mcp.tavily.com/mcp/, which the docs state "supplies its tool descriptions and input schemas at runtime" — i.e., remote content from that URL directly controls the agent's available tools and prompts.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs modifying the agent image manifest and repository files, rebuilding the container image, running host/container management commands (docker/onecli/ncl), registering MCP servers and restarting agent groups — all actions that change host/runtime configuration and thus the machine's state.