mcp-builder

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The evaluation harness intentionally forwards arbitrary tool outputs and tool-use metadata to an external LLM (Anthropic), and the reference examples include exposing local files and eliciting API keys — together these patterns enable easy data exfiltration of local files or credentials if misused.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/evaluation.py, the agent ingests outsider-authored free text from the evaluation XML’s <question> field and passes it directly to client.messages.create as the user message, then uses that for tool calls in agent_loop.