mcp-setup

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly asks for API keys and personal access tokens and constructs CLI commands and HTTP headers that embed those secrets verbatim (e.g., -e EXA_API_KEY=, -e GITHUB_PERSONAL_ACCESS_TOKEN=..., Authorization: Bearer ), forcing the LLM to handle and output secret values.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). This skill's SKILL.md explicitly instructs configuring Exa Web Search, GitHub integration, and custom HTTP MCP servers (see "Step 1: Show Available MCP Servers" and the "Custom MCP Server" section), which will allow agents to fetch and act on open web content, public GitHub data, and arbitrary URLs that are untrusted and could contain instructions influencing agent behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). Yes — the skill instructs runtime fetching/execution of remote code (e.g., npx -y exa-mcp-server and npx -y @upstash/context7-mcp, docker image ghcr.io/github/github-mcp-server, and an HTTP MCP endpoint at https://api.githubcopilot.com/mcp/) which can execute remote code and/or supply prompts/instructions to agents.