The Agent Skills Directory

[COMMAND_EXECUTION]: The 'Test Runner' code example in SKILL.md uses child_process.execSync to execute shell commands with user-controlled input. The input variable pattern is directly interpolated into the command string (npm test -- ${pattern}) without any sanitization, which allows for arbitrary shell command injection if a malicious string is provided.
[DYNAMIC_EXECUTION]: The skill provides implementation patterns for tools that execute raw SQL queries and shell commands based on user parameters. These templates lack essential security controls such as SQL parameterization or safe shell argument handling, creating a significant attack surface for the tools being created.
[INDIRECT_PROMPT_INJECTION]: The skill defines a framework for tools that ingest and act upon untrusted input from tool arguments, which is a key vector for indirect injection.
Ingestion points: Input captured via request.params.arguments in the MCP server templates.
Boundary markers: The templates do not implement any delimiters to separate instructions from data.
Capability inventory: The examples demonstrate powerful capabilities including shell command execution and raw database access.
Sanitization: The provided code snippets demonstrate no validation or sanitization of input data before it is used in sensitive operations.

mcp