The Agent Skills Directory

COMMAND_EXECUTION (HIGH): The file scripts/connections.py contains the MCPConnectionStdio class which wraps mcp.client.stdio.stdio_client. This class accepts an unvalidated command string and args list to spawn a subprocess. In an agentic context, if the agent is manipulated into passing a malicious string to this connection factory, it results in arbitrary command execution on the host system.
EXTERNAL_DOWNLOADS (MEDIUM): SKILL.md instructs the agent to fetch documentation and README files from external URLs, specifically https://modelcontextprotocol.io/sitemap.xml and various raw.githubusercontent.com paths. While these point to official protocol repositories, the ingestion of external content that subsequently guides code generation and execution creates a significant attack surface.
REMOTE_CODE_EXECUTION (HIGH): The combination of Phase 2 ('Implementation') and Phase 3 ('Build and Test') in SKILL.md encourages the agent to generate code, build it (e.g., npm run build), and then execute it using the stdio transport. If the code generation phase is compromised via indirect prompt injection from the external documentation fetches, the execution phase provides a direct path to RCE.
INDIRECT_PROMPT_INJECTION (LOW): As required by the security framework:
Ingestion points: SKILL.md (WebFetch instructions for protocol docs), scripts/connections.py (processing tool outputs from external servers).
Boundary markers: Absent. The instructions do not specify delimiters or warnings to ignore instructions within fetched data.
Capability inventory: scripts/connections.py facilitates subprocess execution (stdio_client), and network requests (sse_client, streamablehttp_client).
Sanitization: Absent. There is no evidence of command sanitization or URL validation in scripts/connections.py.

mcp-builder