mfs-ingest

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly asks the user to "paste the value here" for tokens and shows writing TOML with "", which requires the LLM to accept and emit secret values verbatim into generated config/commands.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow can ingest outsider-authored free text from public/third-party sources (e.g., web crawls HTTP pages and github indexes issue/PR bodies/comments) and then the server-side connector output is used for embedding/search, which necessarily places that text into the LLM/embedding context at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill instructs running a runtime git clone and server commands that fetch and execute remote code from https://github.com/zilliztech/mfs.git (SKILL.md shows git clone https://github.com/zilliztech/mfs.git && cd mfs/server/python && uv sync && uv run mfs-server setup && uv run mfs-server run), which is a high-risk external dependency used at runtime.