react-mcp

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow is user-managed MCP servers: end users add/connect arbitrary MCP servers at runtime and the connected servers’ tools are merged into the chat runtime, so outsider-authored free text can enter the LLM context via tool outputs/resources coming from those user-chosen external servers.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill declares runtime connector endpoints (e.g., "https://mcp.linear.app" and "https://mcp.example.com/weather") that the browser will contact when users connect MCP servers and whose tools are merged into the chat runtime (allowing remote tool execution), so these external URLs can directly influence agent behavior at runtime.