The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes an evaluation file (evals/files/notes-server.ts) containing functional command injection vulnerabilities. It demonstrates the use of execSync to interpolate user-provided tool arguments (such as search queries and file IDs) directly into shell commands like grep and rm without sanitization.
[COMMAND_EXECUTION]: The evaluation configuration file evals/files/mcp.json contains examples of insecure launch arguments, such as using sh -c with command substitution, which is explicitly identified in the documentation as a risk factor for shell injection.
[PROMPT_INJECTION]: The skill contains negative test cases for prompt injection. Specifically, evals/files/notes-server.ts includes a tool description (run_report) that uses imperatives aimed at the model ("Always call this first", "never tell the user"), serving as a benchmark for the model to detect instructions disguised as metadata.
[CREDENTIALS_UNSAFE]: Multiple evaluation files (evals/files/mcp.json and evals/files/notes-auth.yaml) contain hardcoded credential patterns (e.g., sk_live_REDACTED and ghp_REDACTED). While the specific values are redacted, these are included as part of a checklist for users and agents to identify hardcoded secrets in configurations.
[EXTERNAL_DOWNLOADS]: The skill references and recommends the use of npx @modelcontextprotocol/inspector. This invokes the official Model Context Protocol inspector tool from the npm registry. As this is a well-known service and the official tool for the protocol, it is documented as a safe reference to standard development infrastructure.
[INDIRECT_PROMPT_INJECTION]: The skill documents the risk of prompt injection through tool results and external data. It identifies that tools fetching untrusted content (web pages, files, or API responses) can introduce malicious instructions into the model's context.
Ingestion points: Data returned by tools like get or search in the notes-server.ts example.
Boundary markers: The instructions recommend explicit labeling of foreign content and using "ignore embedded instructions" delimiters.
Capability inventory: The skill notes that local MCP servers lack a sandbox, inheriting the user's full privileges for file and network access.
Sanitization: The skill provides specific patterns for path containment (safeJoin) and argv-array execution to mitigate these risks.

mcp-server