The Agent Skills Directory

[COMMAND_EXECUTION]: A SQL injection vulnerability exists in the templates/full-server.ts file within the search-database tool. The tool directly interpolates the user-provided table argument into a SQL query string (`SELECT * FROM ${table} WHERE name LIKE ? LIMIT ?`) without sanitization or validation against a whitelist. This pattern could allow unauthorized access to database tables or execution of arbitrary SQL commands if the driver supports multi-statement execution.- [COMMAND_EXECUTION]: The project initialization script scripts/init-mcp-server.sh performs shell-based scaffolding, creating directories and installing dependencies using npm install based on user input.- [EXTERNAL_DOWNLOADS]: The skill downloads standard Node.js packages from the official npm registry, including @modelcontextprotocol/sdk, hono, and zod, as part of its project setup and maintenance workflows.- [INDIRECT_PROMPT_INJECTION]: The skill defines tools and resources that ingest data from external APIs (such as OpenWeatherMap) and databases (Cloudflare D1). These patterns currently lack boundary markers or explicit instructions to prevent the model from following malicious commands that might be hidden within the ingested data.

typescript-mcp