The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The documentation instructs users to install the mcp Python package and utilize npx (Node.js) or uvx (Python/uv) to download and execute MCP servers directly from public registries. While common for development, this facilitates the execution of unverified remote code.
[COMMAND_EXECUTION]: The skill's primary function is to launch and manage MCP servers as local subprocesses using the stdio transport. Although it implements a 'filtered' environment (inheriting only specific variables like PATH and HOME), it allows the agent to execute arbitrary commands defined in the ~/.hermes/config.yaml configuration file.
[DATA_EXFILTRATION]: The HTTP transport implementation allows the agent to send sensitive information, such as Authorization headers and bearer tokens, to remote server URLs. Additionally, the 'Sampling' feature allows remote servers to receive the results of LLM completion requests, which could be exploited to exfiltrate data contained in the agent's context.
[INDIRECT_PROMPT_INJECTION]: The skill establishes a significant surface for indirect prompt injection:
- Ingestion points: Data enters the agent context through list_tools() metadata and the results of individual tool executions from external MCP servers (SKILL.md).
- Boundary markers: The skill documentation mentions redacting credentials in error messages, but does not specify the use of strict delimiters or instructions to ignore embedded prompts in tool outputs.
- Capability inventory: The skill allows subprocess spawning, network operations (HTTP), and dynamic tool registration.
- Sanitization: Credential stripping is applied to error messages, but there is no evidence of sanitization for general tool output content provided by external servers.
[DYNAMIC_EXECUTION]: The skill uses sampling/createMessage to allow external servers to dynamically request LLM completions and potentially chain multiple tool calls. If connected to an untrusted server, this allows for dynamic, server-driven execution patterns within the agent's session.

native-mcp