The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides tools for direct terminal interaction on the host machine, such as mcp__desktop-commander__start_process and mcp__desktop-commander__interact_with_process. The instructions explicitly warn that these terminal commands are not restricted by the allowedDirectories configuration, meaning they have broad access to the local filesystem.
[INDIRECT_PROMPT_INJECTION]: The skill enables an attack surface for indirect prompt injection by facilitating the ingestion of untrusted data from local files and remote URLs via mcp__desktop-commander__read_file (with the isUrl: true flag). This data is then processed in a context where the agent has powerful local execution capabilities.
Ingestion points: The mcp__desktop-commander__read_file tool described in SKILL.md and references/desktop-commander.md allows the agent to ingest content from arbitrary local paths and web URLs.
Boundary markers: The skill lacks explicit instructions or delimiters to isolate ingested content or prevent the agent from following instructions embedded within that content.
Capability inventory: The skill includes a comprehensive suite of powerful tools across all files, including terminal access (start_process), file system modification (write_file, edit_block, move_file), and process management (kill_process).
Sanitization: There are no mentioned mechanisms for sanitizing or filtering content read from external files or URLs before it is processed by the agent.

desktop-commander