The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references several external resources, all originating from well-known and trusted technology providers including npmjs.com, github.com (specifically the mastra-ai organization), and mastra.ai official documentation.
[COMMAND_EXECUTION]: The skill includes documentation for standard CLI tools such as npx, npm, and mastra. These are standard development operations required for the framework's intended use and do not involve suspicious or unauthorized command injection.
[REMOTE_CODE_EXECUTION]: While the skill mentions Model Context Protocol (MCP) servers and remote tool integration, these are documented features of the framework intended for connecting to developer-controlled infrastructure. No evidence of unauthorized remote script execution (e.g., curl | bash from unknown sources) was found.
[DATA_EXFILTRATION]: The skill documents how to handle sensitive information like API keys via .env files and includes guardrails (PIIDetector, SystemPromptScrubber) to prevent accidental data exposure. No patterns were detected that attempt to steal or exfiltrate user credentials.
[DYNAMIC_EXECUTION]: The skill uses Python and TypeScript scripts for maintenance tasks (integrity checks, update monitoring). These scripts perform local file operations and metadata validation without incorporating untrusted external input into executable contexts.
[INDIRECT_PROMPT_INJECTION]: The skill documents the use of boundary markers and guardrail processors (PromptInjectionDetector) to mitigate risks associated with processing untrusted data, demonstrating security best practices.

mastra