mcp-builder
Warn
Audited by Snyk on Feb 16, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 1.00). The skill explicitly instructs agents to fetch and read open/public third-party content (e.g., "https://modelcontextprotocol.io/sitemap.xml", "https://raw.githubusercontent.com/modelcontextprotocol/.../README.md", and "use web search and WebFetch as needed"), so the agent will ingest untrusted, user-accessible web content as part of its workflow.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 1.00). The evaluation harness (scripts/evaluation.py) accepts a runtime MCP server URL (e.g., https://example.com/mcp) and will connect to that external endpoint to load tool definitions and invoke tools during execution, which directly controls the agent's prompts and executes remote tool code.
Audit Metadata