The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to download and execute code from external sources:
Downloads and runs the @ankimcp/anki-mcp-server package via npx.
References binary .mcpb bundles from github.com/ankimcp/anki-mcp-server/releases.
[COMMAND_EXECUTION]: Installation requires the execution of shell commands, including npm install, npx, and ngrok setup, which may run with the user's local permissions.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection:
Ingestion points: Processes card content (Front/Back fields), deck names, and tags from the local Anki database (e.g., via get_due_cards, findNotes, notesInfo).
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are specified in the provided documentation.
Capability inventory: Includes tool calls to delete notes (deleteNotes), update card content (updateNoteFields), and read/write local media files (storeMediaFile, retrieveMediaFile).
Sanitization: No evidence of sanitization for ingested card content before processing by the LLM.
[DATA_EXFILTRATION]: The storeMediaFile tool allows the agent to read arbitrary local files by providing a file path to the data argument (e.g., data: "/Users/username/Downloads/diagram.png"). If an attacker provides a path to sensitive files (like SSH keys or configuration files), the agent could potentially read and 'store' them in Anki or send them over an ngrok tunnel if configured.

anki-mcp-server-integration