The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill targets and reads from multiple sensitive application configuration paths, including ~/.claude.json, ~/.cursor/mcp.json, and ~/.minimax/mcp/tokens.json. These files are explicitly identified in the skill as potentially containing Bearer tokens and API keys.
Note: The skill provides mitigating instructions that forbid the agent from outputting these sensitive fields in dry-runs, backups, or logs.
[INDIRECT_PROMPT_INJECTION]: The skill acts as an ingestion and merging tool for third-party MCP server configurations. This functionality creates a surface where a malicious server entry (containing dangerous shell commands in the command or args fields) could be written into a developer's IDE or agent environment.
Ingestion points: Reads configuration files from multiple platforms including Codex, Claude Code, Cursor, WorkBuddy, ZCode, Qoder, MiniMax Code, and Kiro.
Boundary markers: The skill requires a "dry-run" and user "authorization" step before writing, although it does not define specific string delimiters for untrusted content.
Capability inventory: The skill possesses the capability to perform file read and write operations across a wide range of sensitive local application directories.
Sanitization: The skill instructs the agent to verify the server entry schema and audit directory ownership prior to writing, but lacks explicit validation rules for executable command fields within the configuration data.

install-mcp