The Agent Skills Directory

[DATA_EXFILTRATION]: The extract-url handler in SKILL.md enables fetching content from arbitrary URLs. Without explicit SSRF protections (such as IP/domain allowlisting), this could be used to probe internal network resources or exfiltrate data from restricted environments.
[DATA_EXFILTRATION]: The extract_file and batch_extract MCP tools accept file_path parameters. This presents a local file read or Path Traversal risk, allowing an agent to potentially access sensitive system files outside the intended data directory if the implementation lacks rigorous path validation.
[PROMPT_INJECTION]: The server is designed to ingest and process untrusted external content from file uploads and remote URLs, which creates a significant surface for indirect prompt injection.
Ingestion points: extract_handler and extract_url_handler (documented in SKILL.md).
Boundary markers: Not documented; there is no mention of delimiters or instructions to ignore embedded commands within processed documents.
Capability inventory: The skill facilitates local file system access and network requests (via reqwest).
Sanitization: While the documentation notes multipart validation and magic byte checks, it lacks specific security controls for preventing the agent from obeying instructions embedded in the extracted text.

api-server-mcp