The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's installation instructions include downloading a shell script from a remote GitHub repository (https://raw.githubusercontent.com/xyTom/coding-tools-mcp/main/scripts/install.sh) and piping it directly into bash. This pattern bypasses safe installation practices and allows for arbitrary code execution from a non-trusted source.
[COMMAND_EXECUTION]: The exec_command and write_stdin tools allow the AI agent to execute arbitrary shell commands on the host system. Although 'Safe Mode' is mentioned, the core capability presents a significant security risk, especially when used in 'Trusted' or 'Dangerous' modes where safety constraints are relaxed.
[EXTERNAL_DOWNLOADS]: The skill facilitates downloading and installing external software, including the core package via uvx and various tunnel clients (cloudflared, ngrok, devtunnel) through automated scripts. These downloads originate from external, unverified repositories.
[DATA_EXFILTRATION]: The skill combines extensive file system access (read_file, search_text) with network-capable functionality like remote tunnels and exec_command. This creates a pathway where sensitive local data could be read and exfiltrated to an external location.
[PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection as it ingests untrusted data from the workspace and command outputs.
Ingestion points: File contents, directory listings, git history, and stdout/stderr from executed commands (e.g., read_file, git_log, exec_command).
Boundary markers: None identified in the instruction set to help the agent distinguish between its own logic and data content.
Capability inventory: Full shell access via exec_command, file-writing via apply_patch, and interactive session management via write_stdin.
Sanitization: While the tool implements internal environment filtering, there is no documented sanitization for the data passed back to the agent context.

coding-tools-mcp-server