The Agent Skills Directory

[COMMAND_EXECUTION]: Configures and executes local commands (via npx, bun, or node) to run MCP servers. The provided examples target official registries and established service providers such as Brave, Microsoft, and the Model Context Protocol organization.
[EXTERNAL_DOWNLOADS]: References and downloads configuration data from official GitHub repositories (e.g., modelcontextprotocol/servers, microsoft/playwright-mcp, supabase-community/supabase-mcp) and well-known service domains.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data when searching for and documenting new MCP servers, creating a potential attack surface.
Ingestion points: Web search results and GitHub repository content fetched during MCP discovery (described in SKILL.md).
Boundary markers: None explicitly mentioned to wrap external content or warn the agent about embedded instructions.
Capability inventory: Writing new documentation files to references/mcps/ and configuring local command execution in opencode.json (SKILL.md, references/mcps/*.md).
Sanitization: Metadata from discovered servers is parsed and stored without explicit sanitization steps.

mcp-installer