The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The scripts/evaluation.py script enables the execution of local binaries to launch MCP servers based on parameters provided at runtime. This capability, while necessary for the skill's purpose of testing local servers, allows for the execution of arbitrary commands if the parameters are influenced by a malicious actor.
[COMMAND_EXECUTION]: The scripts/connections.py module implements a standard MCP stdio client that spawns subprocesses using StdioServerParameters. This is a privileged operation that provides the agent with a mechanism to interact with the local operating system.
[INDIRECT_PROMPT_INJECTION]: The evaluation harness in scripts/evaluation.py is vulnerable to indirect prompt injection.
Ingestion points: Untrusted data enters the agent's context through the evaluation XML file (eval_file) and through tool outputs received from the MCP server being tested (connection.call_tool).
Boundary markers: The evaluation prompt uses XML tags to structure the agent's response, but there are no robust delimiters or safety instructions applied to the external tool outputs being processed.
Capability inventory: The agent has the capability to execute tools, make network requests to the Anthropic API, and launch local processes.
Sanitization: External content from tools is serialized to strings or JSON, but no semantic filtering or sanitization is performed to prevent embedded instructions from influencing the agent's reasoning loop.
[EXTERNAL_DOWNLOADS]: The skill instructions in SKILL.md direct the agent to fetch protocol documentation and SDK README files from well-known sources, specifically modelcontextprotocol.io and the official Model Context Protocol GitHub repositories. These operations are documented as intended behavior for research and planning.

mcp-builder