The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill uses a local callback server (scripts/callback_server.js) that writes OAuth authorization codes and state parameters to /tmp/mcp_oauth_code.txt and /tmp/mcp_oauth_state.txt. On multi-user systems, the /tmp directory is often world-readable, which could allow other local users to intercept the authorization code before it is exchanged for a token.
[COMMAND_EXECUTION]: The authentication process relies on several host-level commands, including curl for network requests, node for executing local scripts and PKCE generation, open for launching the system browser, and kill (via lsof) for process management. These commands provide the agent with significant execution capabilities on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection through the ingestion of untrusted OAuth metadata from external servers.
Ingestion points: Metadata is fetched from the user-provided MCP_SERVER_URL and the discovered AUTH_SERVER in SKILL.md (Steps 1 and 2).
Boundary markers: No delimiters or safety instructions are present to prevent the agent from misinterpreting embedded instructions within the remote metadata.
Capability inventory: The agent uses curl, node, and open across SKILL.md to process and act on the ingested data.
Sanitization: The skill extracts specific JSON fields but interpolates them directly into shell commands and URLs without additional validation or sanitization.

mcp-oauth