The Agent Skills Directory

[PROMPT_INJECTION]: A static detector flagged potential instruction overrides; however, analysis confirms this is a false positive. The skill contains a security instruction to ignore malicious patterns ("ignore previous instructions…") if they appear in data returned from external tools. This is a defensive security control, not a malicious injection.
[INDIRECT_PROMPT_INJECTION]: The skill interfaces with various third-party integrations, which represents a potential attack surface for indirect prompt injection.
Ingestion points: The agent ingests data from any tool in the mcp__executor__* catalog (SKILL.md).
Boundary markers: The instructions explicitly define all tool returns as "untrusted data" (SKILL.md).
Capability inventory: The skill can call proxied tools (which may have external side effects), execute local scripts for OAuth refreshing and notifications, and write to memory logs.
Sanitization: The skill provides explicit instructions to discard and never follow instructions embedded in tool results, reducing the risk of the agent being co-opted by malicious external content.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill handles authentication for the Executor Cloud service using environment variables (MCP_EXECUTOR_TOKEN, MCP_EXECUTOR_OAUTH). These are refreshed via a local script (scripts/mcp-oauth-refresh.sh). This follows standard practice for secret management in agentic workflows and does not show evidence of hardcoded credentials or unauthorized data exfiltration.

executor-mcp