The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of the mcp-brasil Python package from PyPI and execution via uvx. It is hosted in a repository (github.com/jxnxts/mcp-brasil) that is not part of a verified or trusted organization.
[DYNAMIC_EXECUTION]: The server architecture uses an auto-registry pattern where server.py dynamically scans the filesystem to discover, import, and register modules (FEATURE_META and mcp instances) at runtime. This dynamic loading from computed paths increases the potential attack surface if the local environment is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill serves as a conduit for data from 28 external Brazilian public APIs, which constitutes a significant surface for indirect injection.
Ingestion points: Data retrieved from external government entities such as IBGE, Banco Central, and the Portal da Transparência (SKILL.md).
Boundary markers: The skill does not implement specific delimiters or 'ignore' instructions for the external content retrieved by its tools.
Capability inventory: The skill includes broad network access capabilities and a specific 'redator' tool designed to draft official documents based on external API data.
Sanitization: While the implementation leverages Pydantic v2 schemas for structured data validation, it does not appear to sanitize the string content within those structures for prompt injection patterns.

mcp-brasil-public-apis