The Agent Skills Directory

[SAFE]: The skill manages tool configurations (MCP servers) for development tasks and includes robust internal security guidelines.\n- [COMMAND_EXECUTION]: Local PowerShell scripts (e.g., TOOLS\\Set-McpProfile.ps1, TOOLS\\Migrate-HermesProfiles.ps1) are used to manage project-scoped tool registrations. These are administrative scripts distributed with the skill and do not perform arbitrary or remote command execution.\n- [PRIVILEGE_ESCALATION]: The skill maintains strict boundaries between project-local and machine-wide configurations, requiring explicit user-provided flags (-Global) for broader changes.\n- [DATA_EXFILTRATION]: The skill manages configuration files like ~/.claude.json but explicitly instructs the agent to avoid printing sensitive "parked" entries that could contain credentials, preventing accidental exposure.\n- [INDIRECT_PROMPT_INJECTION]: Profile selection is driven by a local task-recipes.json mapping intent to toolsets. The skill requires "verified project evidence" before activating tools, mitigating risks from untrusted data ingestion.

capability-profiles