The Agent Skills Directory

[Data Exposure & Exfiltration] (LOW): The skill performs network operations via curl and fetch to interact with external or local MCP servers.
Evidence: SKILL.md and scripts/basic.test.ts permit connections to arbitrary endpoints defined by the user via the MCP_ENDPOINT variable.
[Indirect Prompt Injection] (LOW): The skill has an attack surface for indirect prompt injection as it ingests and processes tool metadata and responses from untrusted external servers.
Ingestion points: Server-provided tool names, descriptions, and call results are read in SKILL.md (Phases 2 and 3) and scripts/basic.test.ts.
Boundary markers: Absent; server output is not encapsulated with protective delimiters or instructions to ignore embedded commands.
Capability inventory: The skill possesses the ability to execute shell commands and scripts via Bash and Node runtimes.
Sanitization: Data received from the MCP server is parsed as JSON but not specifically sanitized for natural language instructions before being presented to the agent context.
[Command Execution] (SAFE): The skill executes local scripts included in the distribution (scripts/basic.test.ts, scripts/run-basic-tests.sh).
Evidence: These scripts are part of the skill's source and are used for automated testing as described in the documentation.

mcp-server-evaluations