The Agent Skills Directory

[COMMAND_EXECUTION] (LOW): The skill provides instructions and generates commands for adding MCP servers (e.g., claude mcp add). While it uses shlex.quote in scripts/scan_mcp_servers.py to mitigate command injection when generating suggestions, the execution of these commands remains a deliberate action of the user/agent to fulfill the skill's purpose.
[DATA_EXFILTRATION] (LOW): The script scripts/scan_mcp_servers.py reads sensitive configuration files such as ~/.claude.json and project-level .mcp.json. This is necessary for the discovery process, and no evidence was found of these contents being exfiltrated to an external network.
[PROMPT_INJECTION] (LOW): The skill is susceptible to indirect prompt injection (Category 8). An attacker could place a malicious .mcp.json file in a project directory that, when scanned, causes the agent to suggest or execute unintended commands.
Ingestion points: scripts/scan_mcp_servers.py reads ~/.claude.json and .mcp.json files found via os.walk.
Boundary markers: None present in the script or prompt to distinguish between trusted and untrusted configuration data.
Capability inventory: The skill facilitates claude mcp add commands which can download and execute arbitrary packages via npx or local commands.
Sanitization: The script uses shlex.quote for shell safety but does not validate the integrity or source of the server configurations it discovers.

mcp-server-manager