The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill acts as a bridge to external applications (e.g., Notion, Slack, Linear), which creates a potential surface for indirect prompt injection. Malicious instructions stored within external documents or messages could be processed by the agent when calling these tools.
Ingestion points: Data returned from mcp.call_tool and metadata (schemas/descriptions) from mcp.describe_tool and mcp.list_plugins.
Boundary markers: The skill does not explicitly define delimiters or specific "ignore" instructions for data returned from external MCP servers.
Capability inventory: The skill allows discovery and execution of any tools provided by the user's connected MCP services, which may include broad read/write permissions.
Sanitization: The skill returns parsed Python objects directly from the service providers without specific instructional filtering or sanitization.
[SAFE]: The skill enforces several security best practices:
Credential Safety: It explicitly instructs the agent to never request credentials via environment variables and directs the user to platform-native login flows.
Restricted Autonomy: The skill is designed to prevent the agent from initiating new service connections, requiring manual user intervention via the host interface.
Error Handling: It includes specific handling for PermissionError (honoring user-defined tool policies) and flags errors when servers provide incomplete or untrustworthy inventory data.

mcp