The Agent Skills Directory

[DYNAMIC_EXECUTION]: The scaffold generation logic in scripts/openapi_to_mcp.py is vulnerable to code injection from untrusted OpenAPI specifications. The python_scaffold function inserts the description field from the OpenAPI input directly into Python triple-quoted docstrings without escaping. A crafted description containing triple-quotes can break out of the docstring and execute arbitrary Python code when the generated server.py is executed. Similarly, the typescript_scaffold function inserts the description field directly into single-quoted string literals in the generated server.ts. An input containing single quotes can terminate the string and inject arbitrary JavaScript/TypeScript code.
[INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection by processing external OpenAPI specifications and incorporating their content into generated artifacts without sufficient sanitization or boundary markers. Ingestion points: OpenAPI data is read via the --input argument or stdin in scripts/openapi_to_mcp.py and scripts/mcp_validator.py. Boundary markers: The skill does not implement delimiters or warnings in the generated code or manifests to alert users that content is derived from an untrusted external source. Capability inventory: The skill has the ability to create directories and write files to the local file system using the pathlib module. Sanitization: While the skill sanitizes tool names using a regular expression to allow only alphanumeric characters and underscores, it does not sanitize or escape the description fields before using them in code generation.

mcp-server-builder