nat-mcp-and-serving

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow uses mcp_client to connect to an external MCP server (server.url), and the MCP tool outputs (free-form text from that outsider server) are ingested into the agent’s LLM context when the agent calls those tools.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's mcp_client configuration uses a runtime server URL (e.g., ${KB_MCP_URL} / http://localhost:8000/sse or ${MCP_SERVER_URL}) to auto-discover and register remote MCP tools that the agent invokes, meaning external code/instructions from that MCP server are executed/used at runtime and thus can directly control the agent.