The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill implements strict boundaries to prevent the exposure of sensitive data. It explicitly forbids the agent from reading, printing, or summarizing credential vaults, token caches, or environment variables. A dedicated Node.js helper script, list-server-names.mjs, is used to filter server configuration output, ensuring that only non-sensitive names and sources are visible to the agent context.
[COMMAND_EXECUTION]: The skill performs shell execution through the mcporter CLI and a local Node.js script. It follows security best practices by using execFile instead of exec, employing structured JSON payloads for arguments to avoid shell-quoting vulnerabilities, and requiring explicit user confirmation before executing unfamiliar commands or destructive actions.
[PROMPT_INJECTION]: Instructions mandate that all MCP server definitions, tool descriptions, and resource contents be treated as untrusted external input. The skill includes specific directives to ignore embedded instructions that conflict with user tasks or security rules, mitigating potential indirect prompt injection attacks.
[EXTERNAL_DOWNLOADS]: The skill references official documentation and source code from the mcporter repository on GitHub. It enforces a minimum tool version and directs users to official installation paths to prevent the use of unverified or outdated software components.

use-mcp