mcp-client

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt explicitly tells the agent to ask the user for their Zapier API key and provides examples of placing keys directly in config files or export commands, which would require the LLM to receive and potentially emit secrets verbatim (exfiltration risk).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's CLI and scripts (scripts/mcp_client.py) explicitly connect to remote MCP servers listed in references/mcp-config.json and references/mcp-servers.md (e.g., Zapier, Anysite which scrapes web/YouTube/Reddit), use SSE/streamable HTTP/FastMCP transports to list tools and call them, and directly ingest and return result.content (content.text/data), so it fetches untrusted, user-generated third-party content that can influence subsequent tool calls and agent behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes runtime stdio commands like npx -y @modelcontextprotocol/server-sequential-thinking (seen in references/mcp-config.json and mcp-servers.md), which will fetch and execute remote npm package code at runtime—i.e., external content is fetched and executed as a required server dependency.