temps-mcp-setup
Warn
Audited by Snyk on Mar 1, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill is configured to call an external Temps instance via the TEMPS_API_URL/TEMPS_API_KEY (shown in the env and client config snippets) and uses tools like list_projects/get_project/list_deployments that read and act on that instance's data, so untrusted third-party content from that URL could influence agent behavior.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The skill invokes "npx -y @temps-sdk/mcp" (which fetches and executes the @temps-sdk/mcp package from the npm registry, e.g. https://registry.npmjs.org/@temps-sdk/mcp) at runtime as a required dependency, so remote code is fetched and executed and can directly control the agent/tooling.
Audit Metadata