The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process $mcp_intent telemetry, which consists of free-text strings authored by customer agents. These strings are considered untrusted input and may contain malicious instructions designed to override agent behavior (e.g., 'ignore the task', 'query something else'). While the skill includes instructions to treat this output as data only, it explicitly notes that this risk is 'accepted, not solved' for internal staff usage.
[DATA_EXFILTRATION]: The skill's scripts (extract_facets.py, canonicalize_intentions.py) transmit customer-authored telemetry text to OpenAI's API (text-embedding-3-small and gpt-4.1-mini). While OpenAI is a well-known service, this involves sending potentially sensitive fragments (customer names, project IDs, etc.) to a third-party processor.
[CREDENTIALS_UNSAFE]: The documentation instructs the user to resolve the OPENAI_API_KEY by reading from a sensitive local file path .env.local. It provides a shell command export OPENAI_API_KEY=$(op read "$(grep -E '^OPENAI_API_KEY=' .env.local | cut -d= -f2- | tr -d '\"')") to extract secrets using the 1Password CLI.
[COMMAND_EXECUTION]: The workflow requires the agent to execute several local Python scripts and complex SQL queries against internal databases to process the telemetry and generate the taxonomy. The agent is specifically tasked with resolving intention labels itself rather than delegating solely to isolated scripts, increasing the execution context's exposure to the untrusted corpus data.

exploring-mcp-tool-original-user-motive