The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill fetches and executes the 'next-devtools-mcp' package from the NPM registry using npx in both SKILL.md examples and scripts/start-server.sh. This is a standard mechanism for utilizing development utilities.
[COMMAND_EXECUTION]: The scripts/mcp-client.py script uses subprocess.Popen with shell=True to spawn MCP server processes based on arguments passed to the script. While functional for development, this creates a sink for shell command execution.
[DATA_EXFILTRATION]: The skill presents an indirect prompt injection surface by design. It is intended to read and process potentially untrusted data from a developer's environment, such as next.config.js and component metadata.
Ingestion points: Data enters the context through scripts/mcp-client.py via tools like get-config and list-routes which read local filesystem content.
Boundary markers: Absent. The skill does not implement delimiters or explicit instructions to ignore embedded commands in the data being read.
Capability inventory: The skill possesses command execution capabilities (subprocess.Popen in scripts/mcp-client.py) and network access (urllib.request in scripts/mcp-client.py).
Sanitization: Absent. There is no evidence of validation or escaping of the content read from the project files before it is processed by the agent.
[DATA_EXFILTRATION]: The skill-report.json file contains self-referential claims regarding its own safety and verdict, which should be treated as data rather than authoritative security conclusions.

nextjs-devtools