The Agent Skills Directory

[Command Execution] (HIGH): The skill provides a CLI for calling MCP tools (npx tsx scripts/cli.ts call-tool). Since MCP tools are external executables or scripts defined in the .claude/.mcp.json configuration, this allows for arbitrary command execution on the host system depending on the configured servers.
[Prompt Injection] (HIGH): The skill is highly vulnerable to Indirect Prompt Injection (Category 8). It ingests untrusted data from external MCP servers to build a tool catalog.
Ingestion points: Dynamic responses from MCP servers listed in .claude/.mcp.json are saved to assets/tools.json and analyzed by the LLM.
Boundary markers: None. The skill documentation suggests the LLM analyzes assets/tools.json directly for tool selection, which could contain malicious instructions embedded in tool descriptions.
Capability inventory: High. The skill can execute tools via scripts/cli.ts and gemini -y, creating a direct path from untrusted metadata to code execution.
Sanitization: No sanitization or validation of the schemas provided by external MCP servers is mentioned.
[Credentials Unsafe] (MEDIUM): The skill specifically targets .claude/.mcp.json and .gemini/settings.json. These files are standard storage locations for MCP server configurations which frequently contain sensitive API keys and authentication tokens for third-party services.
[External Downloads] (LOW): The skill recommends installing gemini-cli. Per [TRUST-SCOPE-RULE], google-gemini/gemini-cli is a trusted repository, so this download is classified as LOW severity despite its powerful capabilities.

mcp-management