The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill includes the mcp__rube__RUBE_REMOTE_BASH_TOOL which enables the execution of remote shell commands, representing a significant security risk if accessed maliciously.
[DYNAMIC_EXECUTION]: The mcp__rube__RUBE_REMOTE_WORKBENCH tool allows for the execution of Python code within a sandbox at runtime. This tool includes helpers such as run_composio_tool() and proxy_execute(), which can be used to dynamically assemble and run instructions.
[PERSISTENCE]: The skill provides the mcp__rube__RUBE_MANAGE_RECIPE_SCHEDULE tool, which allows users to schedule automated workflows using cron expressions. This capability can be used to establish persistent, repeated execution of commands or data exfiltration scripts.
[COMMAND_EXECUTION]: The mcp__pal__clink tool provides 'External CLI integration,' creating a surface for the execution of command-line tools and utilities outside of the immediate agent environment.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill interacts with over 500 external platforms (Slack, Gmail, GitHub, Discord, etc.) in the 'Rube MCP' section, reading content like PR summaries or messages to trigger workflows.
Boundary markers: The skill lacks explicit instructions or boundary markers to treat data retrieved from these external sources as untrusted or to ignore embedded instructions.
Capability inventory: The orchestration capabilities combine shell access (REMOTE_BASH), code execution (REMOTE_WORKBENCH), and multi-app writes (MULTI_EXECUTE), providing high-impact tools for an injection attack to exploit.
Sanitization: There is no evidence of sanitization, filtering, or validation of the data ingested from integrated apps before it is processed by the agent or passed to execution tools.
[DATA_EXFILTRATION]: The skill's ability to 'orchestrate' across apps like Snowflake, Gmail, and Slack, combined with network-capable tools like REMOTE_BASH and MULTI_EXECUTE, creates a high-risk environment where sensitive corporate or personal data could be harvested and sent to external endpoints.

sc-mcp