The Agent Skills Directory

[DATA_EXFILTRATION]: The skill's documentation provides a vulnerable example for a ResourceTemplate that allows arbitrary file reading from the local filesystem. The provided code snippet read=lambda vars: Path(vars["path"]).read_text() combined with the file:///{+path} URI template allows any MCP client to read sensitive files (such as /etc/passwd or configuration files) accessible to the server process by providing a relative or absolute path.
[PROMPT_INJECTION]: The conversational ask tool exposes a context parameter that is directly prepended to the user message, creating a surface for indirect prompt injection where untrusted data can override the agent's instructions.
Ingestion points: The message and context arguments in the ask tool defined in SKILL.md.
Boundary markers: Absent. The documentation states the context is prepended without mention of delimiters or instructions for the agent to ignore embedded commands.
Capability inventory: The server process has file system access (as demonstrated in the resource example) and can execute agent logic/tools.
Sanitization: No validation or sanitization of input variables is described for either the file paths or the conversational context.
[EXTERNAL_DOWNLOADS]: The skill references the installation of the ag2 package with the mcp extra from PyPI. This is a standard installation from a well-known service for the vendor's own library and is considered a safe dependency reference.

ag2-mcp