The Agent Skills Directory

Indirect Prompt Injection (HIGH): The skill exhibits a high-risk vulnerability surface by combining external data ingestion with command execution capabilities.
Ingestion points: The agent is instructed in SKILL.md (Phases 1.2, 1.3, 1.4) to fetch and read content from modelcontextprotocol.io, GitHub, and user-provided API documentation.
Boundary markers: There are no instructions or mechanisms to sanitize or delimit this external content to prevent the agent from obeying embedded instructions.
Capability inventory: scripts/connections.py implements the MCPConnectionStdio class, which uses mcp.client.stdio.stdio_client to execute system commands with arbitrary arguments and environment variables.
Sanitization: No validation or restriction is placed on the commands or arguments passed to the stdio client.
External Downloads (MEDIUM): The skill directs the agent to fetch resources from external domains including modelcontextprotocol.io and raw.githubusercontent.com/modelcontextprotocol. These sources are not included in the Trusted External Sources list, making the content unverifiable at runtime.
Command Execution (MEDIUM): The inclusion of scripts/connections.py provides the agent with the ability to spawn subprocesses. While intended for local MCP server integration, this capability is dangerous if the agent's decision to execute a specific command is influenced by the untrusted data it is instructed to process.

mcp-builder