The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The file examples/bad-order-tools.java contains a code snippet demonstrating a method execute(String command) that passes arbitrary string input to a shell.run() call. Although this is documented in SKILL.md as a 'Gotcha' and an example of poor tool design ('bad-order-tools'), the pattern itself represents a potential vulnerability for arbitrary command execution.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of tools that ingest untrusted data from an agent via the @McpToolParam annotation (e.g., the orderId parameter in examples/OrderMcpTools.java). This creates a surface area for indirect prompt injection if the processed data contains instructions intended to influence the agent's behavior.
Ingestion points: examples/OrderMcpTools.java, examples/good-order-tools.java (parameters passed to methods annotated with @McpTool).
Boundary markers: The documentation recommends returning structured DTOs rather than persistence entities, but the examples do not demonstrate the use of specific prompt delimiters or 'ignore' instructions for the parameter values themselves.
Capability inventory: Tools created following these patterns have access to application domain services such as OrderService and potentially other backend resources.
Sanitization: The SKILL.md documentation provides explicit remediation guidance, advising developers to 'Validate tool arguments and apply domain authorization inside every capability' and to not trust tool hints as a substitute for server-side authorization logic.

mcp-server