The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill is designed to download and execute MCP servers from remote package registries using tools like npx and uvx. Although the documentation highlights trusted sources like Cloudflare and official MCP repositories, the mechanism itself allows for the execution of arbitrary packages if configured in the registry file.
[COMMAND_EXECUTION]: The execute_mcp_code tool enables the execution of JavaScript/TypeScript code. The underlying implementation uses the Node.js vm module, which the skill's own security documentation identifies as an insecure boundary that can be escaped via techniques like prototype pollution.
[DYNAMIC_EXECUTION]: The skill dynamically spawns child processes and executes runtime-generated code to interact with MCP servers. It implements a 'Layer 0' hardening strategy that allowlists specific commands (e.g., npm, python, cargo) and denylists sensitive environment variables (e.g., LD_PRELOAD, NODE_OPTIONS) to mitigate hijacking attempts.
[INDIRECT_PROMPT_INJECTION]: The skill ingests tool schemas and descriptions from external MCP servers. If an MCP server returns malicious descriptions, it could potentially influence the code generated by the agent for the execute_mcp_code tool, leading to unintended operations.
[DATA_EXFILTRATION]: Because the skill supports HTTP-based MCP transports and code execution, there is a theoretical path for data exfiltration if the agent is tricked into reading local files and sending them to an attacker-controlled MCP endpoint.

mcp-dynamic-orchestrator