establish-mcp

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/verstak-bridge.mjs, the runtime reads arbitrary free text JSON-RPC messages from the harness over process.stdin (rl.on("line"...JSON.parse(trimmed)), which an outsider can influence by submitting MCP requests (including malicious strings inside JSON fields) to be forwarded/upstream-handled.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The bridge script and skill use the runtime server URL https://nks.lab.mirari.ru/mcp (DEFAULT_SERVER_URL) to POST/receive JSON-RPC messages from the remote MCP which directly control the agent/harness responses, so a remote endpoint is contacted at runtime and its content controls prompts.