ucoz-provisioning-skill

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill requires extracting full uAPI tokens and FTP/password values and writing them into local env/mcp.json files and may ask users to paste passwords into chat or generate env-setting commands, so the LLM must handle secret values verbatim (even if instructed not to echo them), creating a high exfiltration risk if those secrets are ever output.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The runner uses Playwright to load and scrape the live uCoz control-panel DOM (e.g., domain zones/preset cards via page.evaluate() in browser-runner/ucoz-provision.cjs), which is outsider-authored free text from a third-party website that becomes part of the agent’s LLM-visible outputs (e.g., needs payloads like availableCards/availableZones and provision-result.json).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly requires and runs the official MCP server via the npx command "npx -y ucoz-mcp@latest" at runtime, which causes code to be fetched from the npm registry and executed locally (i.e., a runtime remote package fetch/execute dependency).