The Agent Skills Directory

[COMMAND_EXECUTION]: The diagnostic script scripts/diagnose_mcp.py performs unsafe shell command execution using user-supplied arguments. The server_name argument is interpolated directly into an f-string and executed via subprocess.run with shell=True enabled.
Evidence:
In scripts/diagnose_mcp.py, the function run_command (line 15) uses subprocess.run(command, shell=True, capture_output=True, text=True).
The server_name parameter is passed to check_server_availability (line 21) and check_authentication (line 32), where it is used to build the command string: f"manus-mcp-cli tool list --server {server_name}".
Impact: An attacker could craft a malicious server name containing shell metacharacters (e.g., supabase; cat /etc/passwd) to execute arbitrary commands on the underlying system with the privileges of the agent.
[PROMPT_INJECTION]: The skill creates a vulnerability surface for indirect prompt injection by processing potentially untrusted data from command failures without proper sanitization.
Ingestion points: The script takes the server_name as a command-line argument, which the agent is instructed to identify from failed command output (as described in SKILL.md Step 1). If a user provides a malicious server name in a prompt that causes a failure, the agent will extract and use that name.
Boundary markers: There are no delimiters or instructions to ignore embedded commands in the input data within the script or the skill instructions.
Capability inventory: The skill has the capability to execute shell commands via the bundled diagnose_mcp.py script.
Sanitization: No sanitization, escaping, or validation is performed on the server_name input before it is used in a shell context.

mcp-auto-recovery