The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes npx @ora-ai/webmcp-verify to execute a command-line utility for tool registration and invocation testing against a local website.
[EXTERNAL_DOWNLOADS]: The instructions reference the @ora-ai/webmcp-verify package, which is executed via npx, and mentions the @mcp-b/webmcp-polyfill for browser compatibility.
[INDIRECT_PROMPT_INJECTION]: The skill involves processing external data from local websites by discovering and invoking WebMCP tools. This presents a potential attack surface if the website provides malicious tool registrations or outputs.
Ingestion points: SKILL.md describes ingesting tool metadata via getTools() and tool outputs via executeTool().
Boundary markers: The skill advocates for a "security lint" pass to check for agent instructions in names and descriptions, and mentions an "approved plan" for schema comparison.
Capability inventory: The skill uses npx @ora-ai/webmcp-verify (command execution) and browser interaction to perform verification steps.
Sanitization: The instructions include a specific security checklist to ensure no agent instructions or secrets are present in tool registrations.

verify