The Agent Skills Directory

Indirect Prompt Injection (HIGH): The skill directs the agent to ingest documentation and SDK information from external, untrusted sources which then guide code generation and command execution.
Ingestion points: Multiple WebFetch calls to modelcontextprotocol.io and raw.githubusercontent.com/modelcontextprotocol/... defined in SKILL.md.
Boundary markers: Absent. The skill provides no instructions to the agent to distinguish between the developer's instructions and potentially malicious instructions embedded in the external documentation.
Capability inventory: The skill involves writing server code and executing terminal commands (npm run build, npx @modelcontextprotocol/inspector, python -m py_compile).
Sanitization: Absent. There is no validation of the external content before it is used to influence the agent's code generation and execution flow.
External Downloads (MEDIUM): The skill mandates downloading content from the modelcontextprotocol GitHub organization.
Evidence: Fetches READMEs from raw.githubusercontent.com/modelcontextprotocol/typescript-sdk and python-sdk.
Status: The modelcontextprotocol organization is not on the [TRUST-SCOPE-RULE] whitelist, making these untrusted external references.
Command Execution (MEDIUM): The skill instructs the agent to run potentially dangerous build and inspection tools.
Evidence: Use of npx @modelcontextprotocol/inspector and npm run build in Phase 3. If the package.json or external SDKs are compromised via the documentation-led development process, these commands could lead to remote code execution.

mcp-builder