yandex-tracker

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The Yandex Tracker MCP server skill requires the agent to read and search issues, comments, descriptions, and checklists submitted by external users into project queues.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill references github.com/sdamarketing/tracker_mcp and executes an install script via curl from raw.githubusercontent.com/sdamarketing/tracker_mcp/main/install.sh, which constitutes a third-party unofficial operational dependency (medium tier).