The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The scripts/research.sh file uses npx -y mcp-remote https://mcp.tavily.com/mcp to initiate an OAuth flow. This method downloads and executes a package from the npm registry at runtime.
[DATA_EXFILTRATION]: The script recursively scans the ~/.mcp-auth/ directory for *_tokens.json files. This directory is a common storage location for sensitive authentication credentials. While the script filters for tokens issued by Tavily, the broad scanning of a credential directory is a security risk.
[COMMAND_EXECUTION]: The skill executes multiple shell commands to manage files, process data using jq and sed, and perform network operations via curl to external endpoints.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it retrieves and processes content from external websites via the Tavily API. This data is returned to the agent without sanitization or boundary markers. • Ingestion points: Research results from the Tavily API in scripts/research.sh. • Boundary markers: None identified in the script or instructions. • Capability inventory: The script has permissions to read sensitive local directories, perform network requests, and write to the file system. • Sanitization: No content sanitization or instruction-ignoring delimiters are applied to the external data before it is passed to the agent.

research