The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill creates a significant surface for indirect prompt injection by design. It retrieves and processes data from external MCP servers, including web search and browser automation outputs.
Ingestion points: Data enters the agent's context through tools like brave-search and playwright_screenshot as referenced in README.md and assets/tools.json.
Boundary markers: The skill instructions do not include specific delimiters or warnings to help the agent isolate untrusted external content from its core instructions.
Capability inventory: The skill manages tools with powerful capabilities including shell command execution and file system access (e.g., server-filesystem).
Sanitization: There is no evidence of sanitization or filtering logic for external data before it is presented to the agent.
[DYNAMIC_EXECUTION]: The skill provides access to tools that allow for dynamic code execution. Specifically, the chrome-devtools server tools defined in assets/tools.json include evaluate_script, which enables the execution of arbitrary JavaScript within a browser environment.
[EXTERNAL_DOWNLOADS]: Quick-start documentation instructs users to install external dependencies via npm install and suggests global installation of the gemini-cli tool. These operations fetch code from public package registries.
[COMMAND_EXECUTION]: The skill's primary function involves executing shell commands and managing sub-processes (via npx, tsx, and gemini) to interact with configured MCP servers.

mcp-management