service-mesh-implementation

skills-sh:aj-geddes_useful-ai-prompts__service-mesh-implementation

View source

92/100

First Seen

Feb 18, 2026

Last Scanned

Feb 20, 2026

Findings

Score

92/100

MEDIUM 1

LOW 1

Findings (2)

MEDIUM

Kubernetes service discovery SSRF_003

ssrf-cloud L116

Detects Kubernetes internal service URLs and secret paths

.svc.cluster.local

FIX

Validate and sanitize all user-provided URLs before making server-side requests. Resolve DNS and verify the IP is not in a private range before connecting.

FP?

Likely FP if the URL fetch is for a well-known public API endpoint that is hardcoded (not user-controlled) in the tool configuration.

LOW

Auto-confirm flag bypassing user verification MCPCFG_008

mcp-config L358

Detects -y, --yes, or --auto-approve flags in MCP/skill install commands that bypass user confirmation

install --set profile=production -y

FIX

Remove the -y/--yes auto-confirm flag from MCP server launch arguments. This flag bypasses user confirmation prompts and allows unattended execution of potentially dangerous operations.

FP?

Likely FP if the matched text is an isolated flag (-y or --yes) in documentation describing command-line options, not in an actual MCP config.