The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and execute third-party code from the npm registry using the npx utility. This includes the protect-mcp package and the @veritasacta/verify package, which are used for policy enforcement and cryptographic verification.\n- [COMMAND_EXECUTION]: The skill utilizes command-line operations to manage governance hooks and wrap MCP server processes. Examples include npx protect-mcp serve to start a gateway and npx protect-mcp init-hooks, which modifies the local environment to intercept Claude Code tool calls.\n- [PROMPT_INJECTION]: The governance mechanism introduces a surface for indirect prompt injection as it processes and evaluates potentially malicious tool-call data against authorization policies.\n
Ingestion points: MCP tool names and associated argument data (such as file paths or shell commands) are ingested from the agent's execution context into the protect-mcp evaluation engine (SKILL.md).\n
Boundary markers: The skill utilizes Cedar policy syntax (e.g., permit and forbid statements) to define execution boundaries, though the instructions do not specify explicit delimiters for the raw tool data being evaluated.\n
Capability inventory: The system is capable of wrapping subprocesses, monitoring tool execution, and blocking commands based on policy decisions (SKILL.md).\n
Sanitization: The skill demonstrates the use of policy constraints, such as resource.args.path like "src/*", to validate and sanitize tool arguments prior to execution.

protect-mcp-governance