The Agent Skills Directory

[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill uses Python's subprocess.run to interact with host-level keychain management utilities like security (macOS) and secret-tool (Linux).
The code uses a list-based argument format for subprocess calls, which avoids shell invocation and prevents shell injection attacks.
The account parameter, which is received as tool input from the model, is strictly validated against a known list of accounts retrieved from the backend before being used in any command line arguments.
The server specifies a dependency on the mcp library via PEP 723 metadata, which is pinned to a major version and sourced from a standard registry.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill handles sensitive TOTP secrets and generates one-time codes for authentication.
The server is designed to act as a secure boundary, ensuring that seeds (secrets) remain stored locally in the system keychain or a restricted directory (~/.config/totp/) and never appear in the model's context or audit logs.
Audit logs are stored in a dedicated directory with strict file permissions (0700) to prevent unauthorized local access.
[INDIRECT_PROMPT_INJECTION]: The skill documentation explicitly identifies and addresses the risk of indirect prompt injection, referred to as the "code oracle" threat.
It provides clear guidance for users to maintain manual-approval workflows for tool calls and uses code-level allowlists that persist even if model-facing instructions are ignored.

totp-mcp-server