The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/openapi_to_mcp.py generates Python and TypeScript code by concatenating strings with data extracted from an external OpenAPI specification. Specifically, the summary and description fields from the OpenAPI input are inserted directly into Python docstrings ("""...""") or TypeScript strings without escaping. A malicious OpenAPI file can use triple-quotes or backticks to break out of the string literal and inject arbitrary code that would be executed when the generated scaffold is run.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (OpenAPI specifications) to produce tool manifests (tool_manifest.json) used by LLM agents. The description and summary fields from the OpenAPI input are used to populate the natural language descriptions of the resulting MCP tools without sanitization or boundary markers. This creates a surface where a malicious spec can influence an agent's tool selection or behavior through embedded instructions.
Ingestion points: scripts/openapi_to_mcp.py reads JSON/YAML data from the --input file or stdin.
Boundary markers: The generated tool manifests and code do not include delimiters or instructions for the agent to ignore embedded instructions within the descriptions.
Capability inventory: The script has the capability to write files to the local file system (Path.write_text).
Sanitization: While tool names are sanitized using a regex, the description and summary fields are used raw, allowing for injection attacks.

mcp-server-builder