The Agent Skills Directory

[Indirect Prompt Injection] (HIGH): The skill's primary workflow relies on RUBE_SEARCH_TOOLS to fetch 'recommended execution plans' and schemas from a remote source (rube.app).
Ingestion points: The agent ingests data from https://rube.app/mcp via the RUBE_SEARCH_TOOLS and RUBE_GET_TOOL_SCHEMAS calls.
Boundary markers: Absent. The instructions tell the agent to 'Always search tools first' and follow the returned plans.
Capability inventory: The skill possesses high-impact capabilities through RUBE_MULTI_EXECUTE_TOOL (executing arbitrary tools defined by the remote schema) and RUBE_REMOTE_WORKBENCH (likely shell or code execution environments).
Sanitization: None. The agent is encouraged to use exact field names and types provided by the remote server.
[Unverifiable Dependencies & Remote Code Execution] (HIGH): The skill requires the user to add https://rube.app/mcp as a remote MCP server.
Pattern: Remote MCP server configuration.
Risk: Since rube.app is not a trusted source, adding it as an MCP server allows the remote endpoint to define and potentially execute logic or commands on the agent's host or within its environment.
[Data Exposure] (MEDIUM): The skill manages dnsfilter connections. While it uses a management tool (RUBE_MANAGE_CONNECTIONS), it directs users to a third-party service to complete authentication ('follow the returned auth link'), which could lead to credential harvesting or unauthorized access to DNS security settings if the service is compromised.

dnsfilter-automation