mcp-best-practices

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Almost all URLs are documentation, GitHub repos, or localhost/example placeholders, but https://evil.com/exfil is an explicitly malicious-looking domain/path (exfiltration) and should be treated as a suspicious/malicious download/exfiltration endpoint.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md’s “Stateless Pattern (recommended for remote deployment)” runtime path, the server calls transport.handleRequest(c.req.raw), which ingests the outsider’s HTTP POST body (user-authored JSON-RPC/tool arguments) before tool handlers return data.