Stdio Skill

This skill largely does what it says — a tiny MCP stdio server that reads/writes files under repo/stdio. Before installing or running it: - Expect to need Node.js (the script is a Node program) and probably the 'mcporter' helper referenced in SKILL.md; the skill metadata didn't declare these. - The stdio_paths tool returns absolute paths including the repository root; that leaks filesystem layout. If you don't want that disclosed, remove or modify that tool. - The implementation does not prevent symlink escapes: a symlink placed inside a box could cause reads/writes to operate on files outside stdio/. If you plan to run this in an environment with untrusted users dropping files, run it in a sandbox / with a dedicated, minimal-permission account, or ensure boxes are on a filesystem that disallows/filters symlinks. - Run the script in an isolated repository or container and review/modify server.js if you need stricter guarantees (e.g., never returning ROOT, lstat checks to forbid symlinks, or using openat-like APIs where available). - If you need a production-grade dropbox, prefer a thoroughly audited implementation; this one is simple and convenient but has the above operational caveats.