Lethal Trifecta

Customer data is private; outbound API calls. Does not ingest untrusted web-style content in normal use.

Cloud headless browser. Same untrusted-input shape as Puppeteer with persistent sessions.

Scraping platform. Same axes; output is whatever the actor returned.

Broad cloud creds in scope. No untrusted-input ingestion in pure SDK usage. 2/3 only because nothing reads attacker content directly.

Cluster control with kubeconfig is private; outbound to the API server. Pod logs can carry untrusted strings if you read them — push to 3/3 for log-reading workloads.

Same shape. Tavily caches pages it found, which means stale poisoned content can keep coming back.

Same shape. Lenses can constrain the attack surface a bit but do not change the axis count.

DNS, sites, workers — broad outbound. Private API tokens. Add a fetch MCP and you have a trifecta.

Local desktop control = local private state + outbound capability via apps it can drive.

Installs npm packages — effectively arbitrary code execution. Treat as a trifecta even though only two axes are nominally true. Anything it installs inherits the agent's entire trust scope.

Fetches and parses arbitrary OpenAPI specs. Spec contents can carry social-engineering content for the model to follow.

Loads arbitrary URLs and renders them. Highest-quality untrusted-input vector after Puppeteer.

Project secrets private; deployment API outbound; build logs can carry untrusted strings (push to 3/3 if you read them).

Transcript text is user-uploaded. Outbound to YouTube on each pull. Mild but not zero.

GIF metadata is user-supplied. Image content can carry payloads in alt text.

User-generated map data; mostly clean but place names and tags have been used for graffiti before.

On-chain data is public; query results travel outbound. Small input-axis risk from labels.

Local microphone audio is private; outbound to the speech-to-text API.

Same.

Same plus LaTeX macros expand the attack surface marginally.

Same shape as NCBI.

Comments and submissions are attacker-controlled. Outbound when posting. The HN crowd is generally good but not fully trustable.

Gists can be public from anyone; private gists are private (some configs flip this to trifecta).

Same shape as kubernetes.

Metric labels and series can carry attacker strings if exporters are misconfigured. Mostly 2/3.

Returns arbitrary web snippets (untrusted) and uses the Brave API (outbound). No private data access, so attackers need a second server in the stack to complete the chain.

DB read/write plus outbound to the Supabase API. No untrusted-input ingestion in normal use; trifecta needs another server.

Spaces are user-uploaded code that returns user-shaped output. Outbound on each call. Pair with any private-data MCP for full exposure.

Public tweets and replies are untrusted; outbound on every post. Account takes care of one private leg in some configs.

Search results are arbitrary web content. Outbound to DDG. Add any MCP that touches private state for a complete chain.

Same shape as DDG, with neural-ranked results that may rank attacker pages higher when they target the query.

Same shape. Synthesised answers reduce the visible-attack surface but the underlying input remains untrusted.

Self-hosted meta-search. Same axes; you choose your upstreams.

CAPTCHA-bypassing scraper. Untrusted-input by design, outbound to the SaaS.

Fetches a URL, returns markdown. The fetch is outbound; the body is untrusted. Common 2/3 in research stacks.

Same shape as markdownify with broader format support.

Screenshot tools render arbitrary URLs and return image content. Same axes.

Curated source so the untrusted-input risk is much lower than open web. Still nonzero — abstracts can carry payloads.

Public papers, curated. Low-but-nonzero on the input axis.

Same.

Same.

Submissions and comments are user-generated. Posting is outbound.

Pulls library docs from registered sources. Generally curated; small input-axis risk in the long tail.

Reviews and forum-style comments are user content.

Submissions are user-edited. Mild ongoing risk.

Crypto exchange API keys are private and high-value. No untrusted ingestion in normal use, but a 2/3 with very high blast radius if compromised.

Image alt text is user-supplied. Outbound on download.

Same shape as AWS.

State files contain secrets. Outbound to provider APIs. Untrusted-input only via remote modules.

Same shape as Vercel.

Remote files private; commands outbound. Untrusted only if you `cat` adversarial files into the model.

Queue contents may include private payloads; publishing is outbound. No web-style input ingestion.