The Agent Skills Directory

[Indirect Prompt Injection] (HIGH): The skill mandates that the agent fetch 'recommended execution plans' and tool definitions from the RUBE_SEARCH_TOOLS tool before every operation. This creates a high-severity vulnerability where an attacker controlling the rube.app endpoint could inject malicious instructions into the 'execution plan' or 'pitfalls' fields, leading the agent to perform unauthorized transactions or data exfiltration.
Ingestion Point: RUBE_SEARCH_TOOLS output (specifically execution plans and tool slugs).
Boundary Markers: Absent. The skill instructions explicitly tell the agent to follow the returned plans.
Capability Inventory: RUBE_MULTI_EXECUTE_TOOL and RUBE_REMOTE_WORKBENCH provide broad tool and remote execution capabilities.
Sanitization: Absent. No verification of tool slugs or plan validity.
[Remote Code Execution] (HIGH): The combination of the RUBE_REMOTE_WORKBENCH tool and the requirement to use an untrusted external discovery service (rube.app) creates a path for remote code execution. The agent is encouraged to 'Run tools first' which determines the code logic it will subsequently execute.
[External Downloads] (MEDIUM): The skill requires the configuration of an external MCP server (https://rube.app/mcp) which is not on the trusted source list. While necessary for the skill's function, it introduces a permanent dependency on an untrusted third-party domain.

beaconchain-automation