The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to clone a repository from an unverified source: https://github.com/f/mcptools.git during the installation process.
[REMOTE_CODE_EXECUTION]: The installation sequence involves downloading remote source code and compiling it into an executable binary using go build. This allows for the execution of unverified software within the agent's environment.
[COMMAND_EXECUTION]: The skill's core functionality involves executing arbitrary shell commands, including npx, docker, and building binaries. This facilitates the execution of external tools and processes.
[CREDENTIALS_UNSAFE]: The documentation provides examples that demonstrate passing sensitive credentials, such as passwords and bearer tokens, in plaintext as command-line arguments (e.g., --auth-user "username:password" and --auth-header "Bearer your-token-here"). This practice is insecure as it can leak secrets through process lists, shell logs, and environment variables.

mcp-cli