EdgeOne Pages MCP — agentic threat model

Not certain from the listing — The agent relies on external LLMs to generate the HTML/content. If the underlying model is reprogrammed or suffers from adversarial prompt injection, it can be coerced into generating malicious scripts, phishing templates, or defaced content to be deployed.

Not certain from the listing — The agent does not explicitly mention a vector database or RAG pipeline, but any data operations feeding into the HTML generation could be poisoned to inject malicious payloads into the deployed web pages.

The agent framework exposes highly sensitive tools ('deploy-html' and folder deployment) that can be easily misused by an orchestrator or via prompt injection to publish unauthorized files, sensitive local project directories, or credentials to the public web.

The agent interacts directly with Tencent EdgeOne's global CDN. The primary infrastructure threat is the exposure of local files during folder deployment and the consumption of the user's deployment credits/bandwidth, potentially leading to financial denial of service.

Not certain from the listing — There is no mention of built-in guardrails, content moderation, or logging to inspect the HTML content for malicious patterns (like credential harvesting forms) before deploying it to the live URL.

The agent operates using the user's EdgeOne account credentials to provision public URLs. There is a lack of fine-grained authorization controls to restrict what domains or subdomains the agent is allowed to publish to, risking brand reputation damage.

In a multi-agent ecosystem, another compromised or rogue agent could generate malicious payloads and pass them to this MCP agent to automatically distribute malware or phishing campaigns globally without human intervention.