The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download, build, and run software from an untrusted GitHub repository (https://github.com/nakasyou/local-mcp.git). This introduces a supply-chain risk as the external source is not verified.
[COMMAND_EXECUTION]: The skill defines several tools that allow an AI agent to execute arbitrary shell commands on the host system. While it mentions sandboxing (Landlock/Seatbelt), it explicitly provides a without_sandbox tool and a /permissions yolo mode that allows the agent to execute commands with full network and host permissions, bypassing security controls.
[INDIRECT_PROMPT_INJECTION]: The skill creates a high-risk surface for indirect prompt injection.
Ingestion points: The agent can read local files and list directories using read_file and list_directory (SKILL.md).
Boundary markers: There are no instructions or markers to help the agent distinguish between its own instructions and potentially malicious content within the files it reads.
Capability inventory: The agent has the power to write files (write_file), execute shell commands (execute), and access the network (without_sandbox).
Sanitization: No sanitization or validation of file content is mentioned before processing.
[PRIVILEGE_ESCALATION]: The documentation includes instructions for using sudo to install system dependencies (bubblewrap) and move binaries to system paths (/usr/local/bin/). If an agent is tricked into suggesting or executing these commands, it could lead to unauthorized privilege escalation on the host.

local-mcp-file-editing