mcp-expert

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's documentation and examples show connecting to arbitrary remote MCP endpoints and ingesting web content (e.g., references/mcp-building.md's fetch_url tool that GETs arbitrary URLs, references/mcp-core.md's resources/read with https:// URIs, and references/mcp-claude-integration.md showing adding HTTP MCP servers by URL), meaning the agent is expected to read and act on untrusted third‑party content whose outputs can influence tool calls and LLM behavior (prompt-injection via tool output).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill documentation explicitly cites CVE-2025-6514 where mcp-remote fetches OAuth metadata from the server (e.g., https://mcp.example.com/.well-known/oauth-protected-resource) and then uses the returned authorization_endpoint URL unsafely (passed to open()), which at runtime can execute OS-level commands — a clear runtime external dependency that led to RCE.