The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions specify the installation of the laravel/boost package using Composer (composer require laravel/boost --dev). This adds an external dependency that is not a standard component of the core Laravel framework.
[COMMAND_EXECUTION]: The installation process involves executing shell commands via the Laravel CLI (php artisan boost:install), which is standard for Laravel package setup but constitutes local command execution initiated by the skill instructions.
[INDIRECT_PROMPT_INJECTION]: The code examples in SKILL.md create a surface for indirect prompt injection by processing untrusted or external data and interpolating it directly into prompts for the AI agent.
Ingestion points: The AnalyzePost class (SKILL.md) retrieves title and content fields from the Post model to build a prompt. The SearchUsers tool ingests a query string to perform database lookups.
Boundary markers: The AnalyzePost::execute method lacks delimiters (e.g., XML tags or Markdown blocks) to isolate the retrieved database content from the system instructions.
Capability inventory: The skill provides the agent with capabilities to perform database queries (DB::table('users')) and read model resources (Post::with('user')).
Sanitization: There is no evidence of sanitization or instructions to ignore embedded commands within the post->content before it is passed to the AI model in the AnalyzePost tool.

laravel-mcp