configuring-mcp-servers

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes hardcoded, token-looking values (e.g., ghp_..., xoxb-..., figd_...), examples that embed credentials in configs (including a plaintext DATABASE_URL) and a troubleshooting command that echoes $GITHUB_TOKEN, which encourages the agent to handle or reproduce secrets verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly configures and uses MCP servers that fetch and expose open third‑party content (e.g., resources/mcp-architecture.md lists http/https resource URIs and resources/popular-servers.md includes a "puppeteer" server that "scrape[s] web pages", plus Brave Search, GitHub, Slack, Google Drive integrations in SKILL.md) which the client is expected to read via resources.read/prompts/get/tools/call and whose content can directly influence agent prompts and actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The included test script and config template call arbitrary MCP HTTP endpoints (e.g., https://api.example.com/mcp) at runtime, and the MCP protocol explicitly allows servers to return prompts and tool results that the client will inject/execute, so a configured remote URL can directly control agent prompts or behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill documentation explicitly lists Stripe as a popular/community MCP server with "Payment operations, customer management". MCP servers expose "tools" and can be configured with credentials/env vars, which means an agent using this skill could call Stripe APIs to create payments/customers or otherwise execute payment-related actions. That is a specific payment gateway integration (not merely generic HTTP or browser automation), so it constitutes direct financial execution capability.