The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The documentation includes multiple examples containing hardcoded credential patterns and sensitive secrets.
The mcp__flow-nexus__sandbox_configure tool example specifies an anthropic_key using the sensitive prefix sk-ant-....
The mcp__flow-nexus__template_deploy example contains a database_url with embedded credentials: postgres://user:pass@host:5432/db.
The Full-Stack Development configuration snippet hardcodes a NEXTAUTH_SECRET as secret and uses a postgresql:// URI pattern.
[COMMAND_EXECUTION]: The skill provides tools for executing arbitrary commands and scripts in remote environments.
mcp__flow-nexus__sandbox_execute allows for the execution of arbitrary code blocks (e.g., JavaScript) provided as raw strings.
mcp__flow-nexus__sandbox_create and mcp__flow-nexus__sandbox_configure facilitate the execution of shell instructions via startup_script and run_commands parameters.
[REMOTE_CODE_EXECUTION]: The skill enables the retrieval and execution of external code from remote sources.
The Custom Docker Images example demonstrates a startup_script that performs a git clone from GitHub followed by npm install and runtime execution.
mcp__flow-nexus__template_deploy downloads and deploys application templates based on external identifiers.
[EXTERNAL_DOWNLOADS]: The skill references external domains for infrastructure, support, and code fetching.
Documentation and API references are hosted on flow-nexus.ruv.io and its subdomains.
Operational examples involve cloning code repositories directly from github.com.
[DATA_EXFILTRATION]: The skill contains features that could lead to unauthorized data exposure.
mcp__flow-nexus__storage_get_url generates public, time-limited URLs for files stored in platform buckets, creating a risk of data exposure if misconfigured.
mcp__flow-nexus__sandbox_upload and mcp__flow-nexus__storage_upload allow for the transfer of local file content to remote storage resources.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a broad surface for indirect prompt injection through the ingestion of untrusted code and data.
Ingestion points: Untrusted data enters the agent context via mcp__flow-nexus__sandbox_execute (code input), mcp__flow-nexus__challenge_submit (solution code), and mcp__flow-nexus__app_store_publish_app (source code).
Boundary markers: The documentation does not define boundary markers or provide instructions to the agent to ignore embedded commands within processed data.
Capability inventory: The skill includes high-privilege capabilities such as arbitrary code execution, network access, and file system writes.
Sanitization: There are no documented validation or sanitization mechanisms for the code and data processed by the platform tools.

flow-nexus-platform