The Agent Skills Directory

[COMMAND_EXECUTION]: The provided evaluation harness (scripts/evaluation.py) executes local shell commands to launch and test MCP servers.
Evidence: In scripts/connections.py, the MCPConnectionStdio class uses the mcp.client.stdio.stdio_client to spawn subprocesses using the command, args, and env parameters provided via the CLI.
[PROMPT_INJECTION]: The evaluation script processes output from external MCP servers during testing without adequate sanitization, creating a surface for indirect prompt injection.
Ingestion points: scripts/evaluation.py (line 107) captures the result of connection.call_tool.
Boundary markers: Absent; the EVALUATION_PROMPT (lines 18-51) does not include delimiters or instructions to ignore embedded commands in tool outputs.
Capability inventory: The harness allows calling any tool exposed by the server under test, which may include command execution (scripts/connections.py, line 41).
Sanitization: Absent; the tool response is directly converted to a string and passed back to the LLM context.
[EXTERNAL_DOWNLOADS]: The skill instructions direct the agent to fetch documentation from external repositories and domains.
Evidence: SKILL.md (lines 53, 62, 70) contains instructions to use WebFetch for URLs targeting modelcontextprotocol.io and raw.githubusercontent.com/modelcontextprotocol/*. These are official documentation sources for the Model Context Protocol.

mcp-builder