mcp-management

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The skill’s runtime path scripts/cli.ts list-tools → scripts/mcp-client.ts getAllTools() calls each configured MCP server’s tools/list, then serializes the returned tool description/schemas into assets/tools.json for the LLM to read; those tool descriptions are outsider-authored content from the MCP servers (which are not vetted by the operating user).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill spawns subprocesses using npx/installed npm packages at runtime (from entries like "@modelcontextprotocol/server-memory" and the recommended "gemini-cli"), which will fetch and execute remote code when starting MCP servers (e.g. https://www.npmjs.com/package/@modelcontextprotocol/server-memory and https://www.npmjs.com/package/gemini-cli), so external code is fetched-and-executed as a required runtime dependency.