The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.Popen in cli.py and mcp_call.py to launch MCP servers as background processes. These commands are loaded from a local configuration file (~/.mcp-cli/servers.json) which can be populated with arbitrary shell commands via the --add argument, potentially leading to unauthorized command execution if the configuration is manipulated.\n- [CREDENTIALS_UNSAFE]: During setup, the tool reads sensitive files from the user's home directory, specifically ~/.claude/settings.json and ~/.claude.json. These files often contain private API keys, tokens, and other authentication data for AI services. The skill copies this information into its own configuration storage (~/.mcp-cli/), expanding the attack surface for credential theft.\n- [REMOTE_CODE_EXECUTION]: The skill's design facilitates the execution of external code by supporting and encouraging the use of package runners like npx and uvx for MCP servers. Documentation examples in README.md and SKILL.md demonstrate running unverified remote code directly from public registries, which is a high-risk practice.\n- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection vulnerability by ingesting data from external MCP servers (via stdio or HTTP transports) and displaying it without sanitization or boundary markers. A malicious tool response could embed instructions that an AI agent might mistakenly follow. The skill's built-in capabilities, such as spawning subprocesses and making network requests using urllib.request.urlopen, provide an exploitable inventory for such an attack.

mcp-cli