hunt-mcp-security

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes curl examples that embed bearer tokens and simulated user passwords directly in command arguments/payloads (e.g., "Authorization: Bearer USER_A_TOKEN" and "The user's password is X"), which requires the agent to handle or output secret values verbatim and enables exfiltration.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document contains explicit, reusable offensive techniques (unauthenticated tool invocation, SQL/command injection, tool output poisoning to exfiltrate secrets, registering backdoor tools, and an RCE PoC) that enable deliberate data exfiltration, backdoors, and remote code execution.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill workflow text describes runtime testing of an exposed MCP server’s tool endpoints (e.g., /mcp/tools, /mcp/tools/fetch_url, /mcp/tools/query_db) by sending outsider-controlled inputs and, critically, assessing whether returned tool output is ingested back into the agent for prompt injection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill contains runtime curl commands that pass "https://attacker.com/poisoned_page.html" to a fetch tool (poisoning agent prompts) and registers a tool endpoint "https://attacker.com/execute" (allowing remote-controlled execution), so these external URLs are used during runtime to control agent instructions or execute code.