The Agent Skills Directory

[DATA_EXFILTRATION]: The MCP server implementation in assets/mcp-server/index.js allows for arbitrary file read and transmission. The resolveImage function takes the image argument from the MCP tools and resolves it as a file path using resolve(input). It then reads the file's contents using readFileSync(filePath) and converts it to a base64 string, which is subsequently sent to the remote endpoint defined by MIMO_API_BASE_URL via a POST request.
Evidence: In assets/mcp-server/index.js, the resolveImage function lacks any path validation or restriction (e.g., ensuring the path is within a specific directory or that the file is actually an image). The tools recognize_image, read_text_from_image, and explain_screenshot all utilize this vulnerable function.
Risk: An attacker could influence an agent to pass sensitive system file paths (e.g., ~/.ssh/id_rsa, .env, /etc/passwd) to these tools, resulting in the silent exfiltration of the file contents to the configured vision API.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (images) and returns the text output from a third-party vision model directly into the agent's context, creating an indirect prompt injection surface.
Ingestion points: The recognize_image, read_text_from_image, and explain_screenshot tools in assets/mcp-server/index.js fetch data from the Mimo vision API.
Boundary markers: Absent. The vision model's response is returned as raw text without delimiters or instructions for the agent to ignore potentially malicious embedded content.
Capability inventory: The MCP server has capabilities for local file system reads and network operations (POST requests).
Sanitization: No sanitization, validation, or filtering is applied to the vision model's response before it is returned to the agent context.

mimo-image