The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/requirements.txt and scripts/pylock.toml files specify package versions that are significantly ahead of currently released versions (e.g., mcp==1.23.0 vs. current 1.2.1 and python-multipart==0.0.22). The pylock.toml also references a future Python version (>=3.14.3). While this appears to be part of the skill's 'future' theme (March 2026), specifying non-existent versions on public registries creates a risk for dependency confusion or the accidental installation of malicious packages if those version numbers are ever occupied by unauthorized actors.
[COMMAND_EXECUTION]: The skill includes Python scripts (scripts/connections.py and scripts/evaluation.py) designed to handle 'stdio' transport connections for MCP servers. This transport mode requires the execution of arbitrary shell commands and arguments supplied by the agent. While this is the intended mechanism for running local MCP servers, it represents a powerful capability that could be abused to execute unauthorized code on the host system.
[PROMPT_INJECTION]: The scripts/evaluation.py script implements an evaluation loop that reads user-provided XML data (evaluation.xml) and injects it directly into a sub-agent's prompt context. This creates a surface for indirect prompt injection attacks.
Ingestion points: The scripts/evaluation.py file reads the evaluation.xml file through its parse_evaluation_file function.
Boundary markers: Absent. The XML content (questions and answers) is interpolated directly into the message history without delimiters or instructions to the model to ignore embedded commands.
Capability inventory: The sub-agent running the loop has access to the full suite of tools provided by the MCP server being tested, which can include network access and file system operations (via connections.py).
Sanitization: The script uses defusedxml to prevent XML-based attacks like Billion Laughs, but it does not perform any sanitization of the natural language text within the XML tags to prevent prompt injection.

mcp-builder