The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes the mcporter CLI tool through Python scripts (scripts/bulk_add_fields.py and scripts/import_records.py). This execution is handled securely using subprocess calls with argument lists rather than shell strings, and all dynamic inputs (IDs and file paths) are strictly validated.
[EXTERNAL_DOWNLOADS]: The skill documentation recommends installing the mcporter utility via NPM. This is a well-known service for package distribution, and the download is a prerequisite for the skill's functionality.
[PROMPT_INJECTION]: The skill processes external data from CSV and JSON files, creating a potential surface for indirect prompt injection. Analysis: 1. Ingestion points: scripts/import_records.py and scripts/bulk_add_fields.py. 2. Boundary markers: Data is parsed using standard structured formats (CSV/JSON), preventing raw content from being interpreted as instructions by the agent. 3. Capability inventory: Local file access and command execution via mcporter. 4. Sanitization: The scripts implement extensive sanitization, including a path sandbox and resource ID validation.
[SAFE]: The skill incorporates a robust path-resolution mechanism (resolve_safe_path) that restricts all file operations to a user-defined workspace directory, effectively preventing directory traversal attacks. The security posture is further confirmed by a comprehensive suite of automated tests.

dingtalk-ai-table