The Agent Skills Directory

COMMAND_EXECUTION (HIGH): The core functionality of the skill is to spawn subprocesses using StdioClientTransport. It executes the command and args defined in the .claude/.mcp.json configuration file.
Evidence: In scripts/mcp-client.ts, the connectToServer method initializes StdioClientTransport with user-defined commands and environment variables.
REMOTE_CODE_EXECUTION (HIGH): The skill's documentation explicitly encourages the use of npx -y to download and execute remote MCP server packages at runtime. This bypasses local security audits of the executed code.
Evidence: references/configuration.md provides examples using npx -y @modelcontextprotocol/server-memory and other remote packages.
PROMPT_INJECTION (HIGH): Indirect Prompt Injection Surface. The skill enables an agent to process untrusted external data (via web search or filesystem tools) and then use that data to decide which tools to execute next.
Ingestion points: scripts/mcp-client.ts (via tool outputs) and scripts/cli.ts (via CLI arguments).
Boundary markers: No specific boundary markers or instruction isolation techniques are implemented in the tool call logic.
Capability inventory: Full subprocess execution capability via StdioClientTransport and potential filesystem/network access depending on configured servers.
Sanitization: No sanitization of tool arguments or configuration values is performed before execution.
CREDENTIALS_UNSAFE (LOW): The configuration guide suggests storing sensitive API keys directly in the .claude/.mcp.json file or environment variables, which could be exposed if the local environment is compromised.
Evidence: references/configuration.md shows BRAVE_API_KEY being stored in the env block of the JSON configuration.

mcp-management