The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/mcp_client.py uses the stdio transport to launch subprocesses based on the command and args fields defined in configuration files. This capability allows for the execution of any system binary or script available to the environment.
[EXTERNAL_DOWNLOADS]: Documentation in references/mcp-servers.md encourages the use of npx to download and run various MCP server implementations at runtime from the Model Context Protocol registry and other public sources.
[REMOTE_CODE_EXECUTION]: Since the skill's behavior is driven by external JSON configuration (loaded from environment variables, project files, or the user's home directory), an attacker capable of influencing these files can achieve arbitrary code execution on the host machine.
[DATA_EXFILTRATION]: The skill is designed to manage and use sensitive API keys for external platforms like Zapier, GitHub, and Slack. It also has the capability to read local files (via filesystem MCP) and could be configured to transmit that information to external endpoints or third-party tools. Additionally, it reads configuration from the sensitive ~/.claude.json file.
[PROMPT_INJECTION]: The skill ingests data from external sources such as web scrapers, Slack histories, and databases. This ingested content could contain malicious instructions (Indirect Prompt Injection) designed to manipulate the agent into performing unauthorized actions using the skill's own capabilities.

mcp-client