The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill recommends executing unpinned remote packages via npx with the @latest tag (e.g., npx package-name@latest and npx github-mcp@latest). This practice creates a supply-chain vulnerability, as users are encouraged to run code that has not been version-pinned or verified, potentially allowing a malicious update to a package to execute on the user's system.
[REMOTE_CODE_EXECUTION]: The documentation provides an installation command: npx claude-code-templates@latest --mcp=\"github-integration\". This is an explicit instruction to download and execute remote code from a third-party source without version control or publisher verification.
[METADATA_POISONING]: The skill package contains a file named skill-report.json which attempts to mimic an official security audit report. This file contains hallucinated security findings and verdicts (e.g., claiming to be generated by a model called 'codex'), which is a deceptive metadata practice designed to influence or mislead security review processes.
[INDIRECT_PROMPT_INJECTION]: The skill acts as an integration specialist that generates executable configuration files (MCP server configs) based on potentially untrusted user input. This creates a surface for indirect prompt injection, where an attacker-controlled service description could result in the generation of a configuration containing malicious shell commands or environment variable exfiltration patterns.
Ingestion points: User input for MCP server generation (SKILL.md).
Boundary markers: None provided in instructions or templates.
Capability inventory: Generation of JSON configuration files containing command and args fields intended for shell execution.
Sanitization: No input validation or sanitization logic is described.

mcp-integration