The Agent Skills Directory

[PROMPT_INJECTION]: The file references/feedback_loop.md contains strong imperative language designed to override agent behavior, including sections labeled 'Hard rules (violating these is a critical failure)' and instructions marked as 'MANDATORY'. These patterns are intended to bypass standard agent constraints in favor of the skill's specific workflow.
[COMMAND_EXECUTION]: The skill describes a stdio:// transport mechanism in references/client_skeleton.md and references/docker_orchestration.md that parses and executes shell commands from a URL-formatted string. This presents a command injection risk if the source of the SERVER_URL configuration is influenced by untrusted input.
[COMMAND_EXECUTION]: The skill requires the agent to execute a local shell script (tests/run_validation.sh) which manages Docker containers and service orchestration, granting the agent significant control over the local execution environment.
[CREDENTIALS_UNSAFE]: The documentation in references/client_skeleton.md explicitly references accessing sensitive authentication tokens via os.environ['MCP_TOKEN']. While not a hardcoded secret, the automated loop involves the agent handling these credentials during transport configuration.
[INDIRECT_PROMPT_INJECTION]: The skill establishes an autonomous feedback loop where the agent is instructed to modify the project's source code based on tool execution results and scenario definitions. This creates an attack surface where malicious or unexpected tool output could influence the agent to introduce bugs or vulnerabilities into the codebase.
Ingestion points: Tool outputs during tools/call validation and definitions within scenarios.yaml entering the agent's context.
Boundary markers: None explicitly defined in the provided instruction blocks to separate untrusted tool output from instructions.
Capability inventory: File system write access (source code fixes), command execution (run_validation.sh), and network operations via MCP transport.
Sanitization: No explicit sanitization or validation of tool output is mentioned before the agent uses it to diagnose and 'fix' code failures.

mcp-tool-validator