The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script reads sensitive credential data from local storage. It recursively searches the ~/.mcp-auth/ directory for *_tokens.json files and extracts access_token values. This grants the skill access to potentially multiple service credentials stored in that directory.
[EXTERNAL_DOWNLOADS]: The skill uses npx to download and execute a package at runtime. It runs npx -y mcp-remote to initiate authentication, which involves fetching code from the NPM registry and executing it dynamically.
[COMMAND_EXECUTION]: The script executes several shell commands, including find, jq, base64, and curl, to perform its authentication and search tasks. This is part of its core functionality but involves multiple subprocess calls.
[DATA_EXFILTRATION]: The skill transmits retrieved authentication tokens to external Tavily endpoints (mcp.tavily.com and api.tavily.com) to facilitate the search request.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through search results.
Ingestion points: The skill fetches web content and snippets from the Tavily API (scripts/search.sh).
Boundary markers: None identified; search results are directly outputted without delimiters or warnings to ignore embedded instructions.
Capability inventory: The skill has network access via curl and can execute remote code via npx during authentication.
Sanitization: There is no evidence of content sanitization or filtering to prevent malicious instructions in the search data from influencing the agent's next steps.

search