mastra

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The "Companion check" directs the agent to run local shell commands (ls ~/.claude/..., etc.) and suggest running npx to install skills — actions that access/modify the host environment and are not part of the Mastra framework's stated purpose, so they are hidden/out-of-scope instructions and constitute a prompt injection.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill's SKILL.md includes a tool example that fetches public web content (the weatherTool calling https://wttr.in/${city}?format=j1) and the MCPClient docs show connecting to arbitrary external SSE/HTTP URLs, meaning the agent ingests untrusted third‑party content at runtime which can influence tool outputs and subsequent agent behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes an MCPClient example that at runtime connects to an external SSE tool server (new URL('https://my-mcp-server.com/sse')) and uses mcp.listTools() to load remote tool definitions that the agent will use (i.e., remote content that can control agent behavior / cause remote execution), so this runtime URL is a risky external dependency.