idea-reality-mcp-validation

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill uses tools that search and fetch data from external community platforms (GitHub, Hacker News, npm, PyPI, Product Hunt, Stack Overflow), which are selected and searched based on user queries, representing low-risk indirect prompt injection via searched content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs the agent to install and execute a third-party package (idea-reality-mcp via uvx and @smithery/cli) from unknown community sources without pinned digests or verified publisher provenance.