render-mcp

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill instructs users (and shows templates) to embed API keys verbatim in config files and command-line headers (e.g., Authorization: Bearer <YOUR_API_KEY> and --header "Authorization: Bearer ..."), which would require an LLM to include secrets in generated output and risks exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The Render MCP server is configured via an outsider-provided MCP connection (HTTP to https://mcp.render.com/mcp with a user/account bearer token), and the workflow then ingests free text originating from the caller when using tools like list_logs(..., text, ...) to search logs (readable text source).