The Agent Skills Directory

[SAFE]: The skill provides a comprehensive architectural blueprint for implementing authentication for MCP (Model Context Protocol) servers. It focuses on well-established security standards including RFC 7591 (Dynamic Client Registration), RFC 8414 (Metadata Discovery), and RFC 7636 (PKCE).
[CREDENTIALS_UNSAFE]: The provided code samples explicitly implement security best practices by using encrypts to secure sensitive fields like auth_token, oauth_client_id, oauth_client_secret, and access_tokens at rest in the database.
[PROMPT_INJECTION]: The OAuth implementation includes a signed, expiring state parameter generated via a message_verifier. This is a standard and effective defense against CSRF and various injection attacks during the OAuth handshake.
[INDIRECT_PROMPT_INJECTION]: While the skill involves ingesting tool definitions from external MCP servers, it documents a structured process for discovery and synchronization. It provides developers with the patterns needed to handle this data safely within a controlled administrative interface.
[COMMAND_EXECUTION]: The skill does not use any dangerous system calls or shell execution patterns. All network interactions are performed using standard HTTP libraries (Faraday, Net::HTTP) to communicate with defined API endpoints.

mcp-oauth-setup