The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted .mcp.json files which creates a potential surface for indirect prompt injection.
Ingestion points: The audit_mcp_config function reads external .mcp.json files provided by the user.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore natural language instructions that might be embedded within the JSON data fields.
Capability inventory: The skill uses json and re libraries to parse and analyze file content. It does not perform active shell execution or network requests on the data itself.
Sanitization: The skill performs regex-based scanning but does not sanitize the input for potential downstream prompt injection attacks.
[EXTERNAL_DOWNLOADS]: The skill references an external repository for additional governance tools.
Evidence: References the microsoft/agent-governance-toolkit GitHub repository.
Analysis: The reference targets a trusted organization (Microsoft) and is provided for educational/resource purposes, which is considered safe behavior.
[CREDENTIALS_UNSAFE]: The skill contains example strings that match secret patterns.
Evidence: The "Bad" example configuration includes illustrative hardcoded secrets like sk-abc123realkey456 and a database connection string postgresql://admin:password123@prod-db:5432/main.
Analysis: These are clearly marked as examples of insecure practices for auditing purposes and do not represent actual leaked credentials or malicious exfiltration intent.

mcp-security-audit