The Agent Skills Directory

Indirect Prompt Injection Surface: The evaluation harness in scripts/evaluation.py processes questions from a user-provided XML file. These questions are then passed to an LLM as part of its instructions, which could allow maliciously crafted input to influence agent behavior.
Ingestion points: The script reads from a file specified by the eval_file argument in scripts/evaluation.py (line 347).
Boundary markers: While the system prompt uses XML-like delimiters for the agent's response sections, the untrusted question text is directly included in the message history without separate boundary markers to prevent instruction confusion.
Capability inventory: The evaluation agent has access to any tools provided by the MCP server being tested, which is connected via scripts/connections.py. Depending on the server being tested, this could include file or network access.
Sanitization: The script does not perform specific sanitization or escaping on the question text before passing it to the model.
External Documentation Access: The skill directs the agent to retrieve protocol specifications and SDK details from remote repositories to ensure it has up-to-date information.
Evidence: References to modelcontextprotocol.io and github.com/modelcontextprotocol in SKILL.md (lines 53, 67, 72).
Context: These downloads are directed toward official documentation for the technology being utilized and are used to inform the development process.
Local Process Execution: The evaluation harness includes the ability to launch local server processes to facilitate integration testing.
Evidence: The MCPConnectionStdio class in scripts/connections.py (line 86) and its usage in scripts/evaluation.py (line 369).
Context: This is a standard feature for testing locally developed MCP servers and requires the user to explicitly provide the command and arguments via the command-line interface.

mcp-builder