@khushalsagar I'm opening a new PR to add back the 3rd point for prompt injection attacks. I'm focusing here more on the fact that the webmcp tools themselves are potentially a target and clearing them up here.

The threat actor listed here is a malicious user but that doesn't make sense to me. The user already has access to this functionality via the site.

I can imagine a malicious origin manipulating an agent to use a high-value action offered by another site. But that is covered by the attack vectors above. So not following what additional threats this is meant to cover...

I must have glossed over the threat actor when I changed the focus from prompt injection on the input, to the new point on tool implementation as attack targets.

Let me rephrase it - I think this is more of any malicious actors that is able to gain control of agents that has access to WebMCP tool

Hmmm, I'm still not completely convinced that this is highlighting something distinct from other attack vectors. The site has to trust that the Agent being provided with these tools has appropriate mitigations in place so an attacker can't take control of it. Especially with browser-agent which is conceptually trusted the same way the user-agent/browser is.

But doesn't hurt to have this. We can discuss on an issue and conclude if anything is needed for this.