The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill allows the agent to ingest and act upon data from external, user-managed MCP servers, which could contain malicious instructions.
Ingestion points: Data enters the agent's context through connector URLs defined in McpManagerResource, as well as outputs from listResources and readResource (found in SKILL.md and references/setup.md).
Boundary markers: The documentation does not demonstrate the use of delimiters or specific instructions to isolate and ignore malicious content embedded within server responses.
Capability inventory: The skill provides the agent with the callTool capability, allowing it to perform actions on the connected servers based on potentially untrusted data.
Sanitization: There is no evidence of output sanitization or filtering for content retrieved from external MCP tools in the provided implementation examples.
[CREDENTIALS_UNSAFE]: As documented in references/setup.md, the default McpLocalStorage() implementation persists authentication tokens (OAuth and Bearer) in plain text within the browser's window.localStorage. While the skill author provides instructions for implementing safer storage via McpCustomStorage and HTTP-only cookies, the default configuration poses a risk of credential exposure on compromised devices.

react-mcp