mcp-management

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). At runtime, the skill’s CLI connects to configured MCP servers (from .claude/.mcp.json) and ingests their tool/prompt/resource metadata via client.listTools/listPrompts/listResources, which is outsider-authored text coming from third-party MCP server implementations.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill shows runtime use of npx to start MCP servers (e.g., config examples with args like ["-y","@modelcontextprotocol/server-memory"]), which causes npx to fetch and execute packages from the npm registry (https://registry.npmjs.org) at runtime and the skill relies on those external server packages to provide tool functionality.