The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is fundamentally designed to ingest and process data from external MCP servers and tools. These external tools serve as untrusted data sources that could return content containing instructions designed to influence the agent's behavior. The skill possesses extensive capabilities, including subprocess execution (stdio transport) and network operations (SSE/HTTP transports), which form a vulnerability surface if the agent obeys instructions embedded in tool outputs.
Ingestion points: Data returned from tools/call, resources/read, and prompts/get requests across mcp-client.ts, cli.ts, and evaluation.py.
Boundary markers: The evaluation.py script uses XML tags (<summary>, <feedback>, <response>) to delimit agent output, but no explicit sanitization or "ignore instructions" delimiters are enforced for tool responses themselves.
Capability inventory: Subprocess spawning via StdioClientTransport in mcp-client.ts, network requests in connections.py, and local file writing in cli.ts.
Sanitization: Best practices documentation (best-practices.md) recommends input validation via Pydantic/Zod, but the scripts are transparent clients for the tool outputs.
[COMMAND_EXECUTION]: The skill includes scripts (cli.ts, evaluation.py) that facilitate the execution of local MCP servers as subprocesses. This involves launching commands and passing arguments defined in the .claude/.mcp.json configuration file. While this is the intended functionality for local MCP development, it allows for arbitrary command execution within the user's environment based on the configuration provided.
[EXTERNAL_DOWNLOADS]: The implementation guides (building-servers.md, python-guide.md, typescript-guide.md) instruct the user and agent to fetch documentation and SDKs from external sources. These include fetching protocol specifications from modelcontextprotocol.io and README files from official GitHub repositories. Additionally, the skill relies on standard package managers (NPM, Pip) to install necessary dependencies.
[DYNAMIC_EXECUTION]: The cli.ts script dynamically parses JSON arguments provided via the command line to call specific tools. The evaluation.py script also processes tool results dynamically, converting them between strings and JSON objects for the agent to process.

mcp