The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and execute code using uvx idea-reality-mcp and npx -y @smithery/cli install idea-reality-mcp. This fetches packages from the public PyPI and npm registries.
[REMOTE_CODE_EXECUTION]: By using uvx and npx, the skill triggers the execution of third-party command-line tools on the host system. While these tools are central to the skill's function, they represent unverified code execution from external sources.
[DATA_EXFILTRATION]: The skill transmits the idea_text parameter to an external API hosted at https://idea-reality-mcp.onrender.com/api/check. Users should be aware that their project descriptions are shared with this third-party service.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from various untrusted external sources, including GitHub repository descriptions, Hacker News comments, and Product Hunt listings.
Ingestion points: External data is returned in the evidence, top_similars (specifically the description field), and potentially used to generate pivot_hints (SKILL.md).
Boundary markers: There are no explicit instructions or delimiters shown in the tool schema to prevent the AI from following instructions embedded in the fetched descriptions.
Capability inventory: If the agent has file-system or network access, it could be tricked into executing commands found in a malicious repository description.
Sanitization: The skill does not describe any sanitization or filtering of the content retrieved from external APIs.

idea-reality-mcp-validation