The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the installation of an external Python package named jabama-mcp using the uvx tool. This package is retrieved from the public PyPI registry, which is a common practice but involves the introduction of external code dependencies.
[REMOTE_CODE_EXECUTION]: Executing the command uvx jabama-mcp results in the execution of code provided by the package author. The integrity and safety of the skill depend entirely on the security of this external package.
[INDIRECT_PROMPT_INJECTION]: The skill fetches data from external sites (jabama.com, jabama.tours, jabama.events), including user-generated content such as reviews and event descriptions. This content is processed by the agent and could potentially contain malicious instructions intended to manipulate the agent's behavior.
Ingestion points: Data enters the agent context through tools like jb_stay, jb_reviews, jb_event, and jb_tour which retrieve text from external sources.
Boundary markers: There are no explicit instructions or delimiters defined to separate untrusted external content from the agent's instructions.
Capability inventory: The skill uses the tools provided by the jabama-mcp server to query and retrieve data via network operations.
Sanitization: The instructions do not specify any sanitization, filtering, or validation of the data retrieved from external websites.

jabama