The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill retrieves SDK tarballs and release metadata from official sources including the NPM registry and GitHub repositories for the purpose of auditing version changes. These downloads are handled through standard package management and API tools.- [COMMAND_EXECUTION]: The skill utilizes a suite of standard development utilities such as pnpm, npm, gh, git, tar, and shasum. These are used to manage project dependencies, extract archives, and verify the integrity of binary chunks through SHA-256 hashing.- [DYNAMIC_EXECUTION]: It includes a bundled diagnostic script, probe.mjs, which executes the project's built server within a subprocess. This controlled execution is used to snapshot and compare the JSON-RPC wire behavior between SDK versions.- [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as GitHub PR titles and release notes (Ingestion point: SKILL.md Stage 1). It mitigates risks by instructing the agent to treat this data as an index rather than instructions (Boundary marker), and relies on automated Vitest suites and deterministic schema diffing (Capability inventory) to verify the upgrade (Sanitization via hashing and structure comparison).

mcp-sdk-audit