The Agent Skills Directory

[SAFE]: The skill invokes a local Python script (auvik_mcp_server.py) using python3 to facilitate the MCP server operations. This is the expected and legitimate behavior for the skill's functionality.
[SAFE]: Sensitive credentials, including the AUVIK_API_KEY and AUVIK_USERNAME, are managed via environment variables. This follows secure development practices by avoiding hardcoded secrets within the skill instructions or scripts.
[SAFE]: The skill identifies the security risk of disabling TLS verification via the AUVIK_VERIFY_SSL environment variable and explicitly advises against it in the documentation.
[PROMPT_INJECTION]: The skill includes a tool, auvik_list_entity_notes, which ingests arbitrary text data from the Auvik API. This constitutes a surface for indirect prompt injection should an attacker influence the content of notes within the Auvik platform.
Ingestion points: The auvik_list_entity_notes tool in SKILL.md reads notes attached to devices, networks, or interfaces.
Boundary markers: None identified; instructions do not specify the use of delimiters when processing note content.
Capability inventory: The skill is limited to GET (read-only) network operations and local script execution.
Sanitization: No explicit sanitization or filtering of note content is described in the provided instructions.

auvik-inventory