The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes file content from the local system, representing an indirect prompt injection attack surface where documentation or notes could contain instructions intended to divert the AI agent from its system prompt.
Ingestion points: references/server-template.mjs (functions readDoc and callTool search/read files).
Boundary markers: The template does not wrap file content in specific security delimiters or warning instructions.
Capability inventory: The server-template is self-contained and does not include network, write, delete, or shell execution capabilities.
Sanitization: Content is read directly as UTF-8 without further sanitization.
[SAFE]: The skill implements robust security measures including the use of realpathSync and prefix-matching with path separators to prevent directory traversal and symlink-based escape attacks. It also uses an allow-list for file extensions and implements a file size cap to prevent resource exhaustion.

readonly-mcp-wrapper