The Agent Skills Directory

[PROMPT_INJECTION]: The evaluation harness in scripts/evaluation.py is vulnerable to indirect prompt injection because it processes external, potentially untrusted data that is then interpreted by an LLM.\n
Ingestion points: The script reads test questions from an XML file (eval_file) and processes outputs from tools provided by the MCP server being tested.\n
Boundary markers (absent): While the system prompt uses XML-style tags for the agent's own responses, it does not include explicit delimiters or instructions to ignore or treat test questions and tool outputs as untrusted data.\n
Capability inventory: The skill possesses capabilities to execute local commands (via scripts/connections.py using stdio_client) and perform network operations (via sse_client or streamablehttp_client in scripts/connections.py).\n
Sanitization (absent): There is no evidence of sanitization or validation of the questions or tool outputs before they are interpolated into the prompt for the LLM.\n- [COMMAND_EXECUTION]: The scripts/evaluation.py script uses the create_connection factory in scripts/connections.py to execute local shell commands. This functionality is used to launch MCP servers under test using the stdio transport. While this is an intended feature of the tool, it represents a powerful capability that executes user-supplied arguments.\n- [EXTERNAL_DOWNLOADS]: The skill's documentation (SKILL.md) instructs the agent to fetch external resources using WebFetch. Specifically, it points to official MCP sitemaps and SDK documentation on GitHub (modelcontextprotocol/typescript-sdk and modelcontextprotocol/python-sdk). These are recognized as well-known and trusted sources for the protocol being implemented.

mcp-builder