The Agent Skills Directory

[COMMAND_EXECUTION]: The Handlebars template templates/server.ts.hbs generates TypeScript code for an MCP server that uses execSync to execute the gitnexus CLI. Arguments for tools like project_query and project_impact are directly interpolated into a shell command string using double quotes: execSync(`gitnexus query "${args?.query || ""}"`, ...). This implementation is vulnerable to shell injection if the arguments contain shell metacharacters such as backticks, semicolons, or command substitution sequences.
[REMOTE_CODE_EXECUTION]: Because the generated MCP server is intended to be registered with AI clients and executed locally, the command injection vulnerability in the template allows for remote code execution. A malicious prompt or poisoned data processed by the agent could trigger the execution of arbitrary commands on the user's system via the tool interface.
[DATA_EXFILTRATION]: The instructions in LITE.md provide a template for a fetch_api_records tool that performs outbound network requests using fetch(endpoint). While it attempts to redact api_key parameters using a regular expression, the tool permits the agent to send data to any arbitrary URL provided as input, which can be abused for data exfiltration from the local workspace.
[INDIRECT_PROMPT_INJECTION]: The generated server reads the stdout of the gitnexus CLI and returns it as plain text to the agent without any sanitization or boundary markers.
Ingestion points: server.ts.hbs (output of runGitnexus function).
Boundary markers: None implemented in the generated template.
Capability inventory: Uses execSync for shell execution and provides file system navigation hints.
Sanitization: None implemented for the external tool output.

MCP Generator