mcp-connector

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider-authored free text from a connected MCP server is ingested into the agent context via mcp_get_prompt (calls prompts/get and formats result["messages"][*].content.text) and via mcp_call_tool/mcp_read_resource (formats returned content/text fields), with the server content coming from an external (non-user) MCP endpoint.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill opens runtime connections to arbitrary MCP servers (e.g., SSE/HTTP endpoints like "https://mcp.example.com/sse" and "https://mcp.example.com/mcp") and will fetch prompts/tool results from those endpoints which can directly control agent prompts/behavior (the stdio example also shows running "npx @modelcontextprotocol/server-filesystem" which would fetch and execute remote code at runtime).