The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions direct the user to clone an external repository (github.com/noredistribution/mcp-cvp-fun) and execute its content using uv run. Running unverified code from an external source grants that code full access to the agent's execution environment.
[EXTERNAL_DOWNLOADS]: The MCP server implementation is not contained within the skill but is fetched from a remote GitHub repository at runtime.
[COMMAND_EXECUTION]: The skill uses shell-level execution commands (uv run --with fastmcp fastmcp run /path/to/mcp_server_rest.py) to launch the MCP server, providing a mechanism for executing arbitrary Python scripts.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerable surface for indirect prompt injection by ingesting untrusted data from external sources.
Ingestion points: External data is ingested through the get_inventory (device hostnames/metadata) and get_events (alert descriptions/warnings) tools which fetch data from the Arista CloudVision Portal API.
Boundary markers: The instructions do not define boundary markers or delimiters to separate the retrieved data from the agent's internal instructions.
Capability inventory: The skill has the capability to write back to the environment via the create_tag tool (executing multi-step POST requests) and can execute shell commands via uv.
Sanitization: There is no mention of sanitization or validation of the content received from the CloudVision API before it is processed by the agent.
[CREDENTIALS_UNSAFE]: While the skill manages authentication via CVPTOKEN, it follows security best practices by instructing users to store secrets in a .env file rather than hardcoding them. However, it explicitly notes that the community-provided source code disables TLS verification, which could expose these credentials to man-in-the-middle attacks on the local network.

arista-cvp