The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/analyze-traces.ts executes shell commands using execSync where the command string includes the COLLECTION environment variable without sanitization. This allows for potential command injection if a malicious string is provided as the collection filter.
Evidence: const testCmd = collection ? \npm run test:evals -- --testPathPatterns="${collection}" 2>&1` : 'npm run test:evals 2>&1';followed byexecSync(testCmd, ...)`.
[DYNAMIC_EXECUTION]: The script scripts/list-chained-tools.ts dynamically imports a configuration file from a path specified by the MCP_SERVERS_PATH environment variable. This allows the agent to load and execute arbitrary JavaScript or TypeScript files if the path is manipulated.
Evidence: const configPath = path.resolve(projectRoot, mcpServersPath); followed by const configModule = await import(configUrl);.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and parses evaluation log files or command output in scripts/analyze-traces.ts to generate reports. This constitutes an attack surface for indirect prompt injection if the logs contain data from untrusted external sources (e.g., API responses) that have been poisoned with malicious instructions.
Ingestion points: The script reads from a file specified by LOG_FILE or captures stdout from npm run test:evals.
Boundary markers: Scenarios are delimited by === {testName} === headers.
Capability inventory: The skill can execute shell commands, read files, and connect to MCP servers.
Sanitization: There is no evidence of escaping or filtering of the log content before it is parsed and presented in the final report.

discuss-mcp