The Agent Skills Directory

COMMAND_EXECUTION (MEDIUM): The file scripts/connections.py contains the MCPConnectionStdio class which utilizes mcp.client.stdio.stdio_client to execute arbitrary local commands.
Evidence: The class takes command and args parameters and passes them to the underlying transport mechanism which spawns a subprocess.
Risk: While this is the intended functionality for an MCP client builder, it provides a high-privilege capability that could be exploited to run malicious code if the agent is manipulated into executing unauthorized commands.
EXTERNAL_DOWNLOADS (LOW): SKILL.md contains instructions for the agent to fetch external data from non-whitelisted domains for research purposes.
Evidence: References to https://modelcontextprotocol.io/sitemap.xml and raw GitHub README files from the modelcontextprotocol organization.
Risk: This creates a surface for indirect prompt injection where malicious instructions embedded in remote documentation could influence the agent's behavior during the server creation process.
INDIRECT PROMPT INJECTION (LOW): The skill is designed to ingest untrusted data from the web and has powerful capabilities.
Ingestion points: SKILL.md prompts the agent to use WebFetch on external protocol documentation and SDK READMEs.
Boundary markers: None specified for the external data ingestion.
Capability inventory: The skill includes scripts for local command execution (scripts/connections.py) and instructions for building/compiling code.
Sanitization: No sanitization logic is present for the fetched documentation.

mcp-builder