The Agent Skills Directory

[SAFE]: The skill implements a robust auditing workflow for tracking changes in a critical runtime dependency. It appropriately distinguishes between type-level changes and behavior changes that affect the JSON-RPC wire protocol.- [COMMAND_EXECUTION]: The skill utilizes standard project build and test commands (pnpm build, pnpm test, pnpm typecheck) and executes a local utility script (probe.mjs) to automate the comparison of server snapshots. These executions are limited to the project's own source and built artifacts.- [EXTERNAL_DOWNLOADS]: The skill interacts with the NPM registry and GitHub API to retrieve version metadata and package contents for the @modelcontextprotocol package family. These interactions use official CLI tools (npm, gh) and target well-known, trusted sources.- [DATA_EXPOSURE_&_EXFILTRATION]: No sensitive local data or credentials are accessed. The skill reads public configuration files (package.json, pnpm-lock.yaml) and writes snapshots to a user-defined scratch directory for comparison purposes.- [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as GitHub PR titles and descriptions. While this provides a theoretical surface for indirect injection, the risk is mitigated by the skill's specific focus on auditing file paths and structural changes in code, rather than executing instructions contained within the PR metadata.

mcp-sdk-audit