The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions advise the user to install an external package named mrbilit-mcp using the command claude mcp add mrbilit -- uvx mrbilit-mcp. This package is hosted on the Python Package Index (PyPI) and is not from a trusted organization, representing a third-party dependency.
[INDIRECT_PROMPT_INJECTION]: The skill defines tools that retrieve and process untrusted external data, creating a potential surface for indirect prompt injection. * Ingestion points: Data is fetched via tools such as mb_hotel (guest reviews), mb_help (FAQ and guides), and mb_travel_guide (articles and posts). * Boundary markers: The skill does not provide instructions to the agent to use delimiters or to disregard instructions that might be embedded within the external content. * Capability inventory: The tools perform network operations to access undocumented APIs on mrbilit.com. * Sanitization: There is no evidence of sanitization or validation routines to filter malicious content from the retrieved data before it is presented to the agent.

mrbilit