mcp-dynamic-orchestrator

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In list_mcp_capabilities the agent passes user-supplied query (free text) into the orchestrator’s discovery/search path, which can influence which MCP entries/tools are selected (and thus what subsequent provider-generated text is fetched/processed).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The registry examples spawn an MCP process using npx mcp-remote with the runtime URL https://docs.mcp.cloudflare.com/sse (e.g., SKILL.md:29), which the orchestrator will contact at runtime to load tool schemas/responses (and could deliver code/commands the agent uses), so this external endpoint can directly influence prompts or executed behavior.