The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the mastra CLI and curl to interact with Mastra server instances. These commands are used for server discovery, data retrieval, and operational tasks.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to user-specified Mastra server URLs (e.g., via $MASTRA_URL) to fetch schemas, logs, and state information. It also references documentation and blog posts from mastra.ai.
[DATA_EXPOSURE_AND_EXFILTRATION]: While the skill handles sensitive information such as Authorization tokens, it implements security best practices by instructing the agent to never read .env files and to only use variables provided by the user or already present in the shell environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external Mastra servers (such as log messages, agent descriptions, and workflow outputs). While this represents a potential surface for indirect prompt injection, the risk is mitigated by the use of structured JSON parsing via jq and the skill's instruction to treat the CLI/server as the source of truth rather than free-form text.

mastra-api-cli