How to Audit Third-Party SKILL.md, .cursorrules, and mcp.json Files for Prompt Injection and Exfiltration

Developers using Claude Code, Cursor, Windsurf, and Cline regularly clone repositories or install community SKILL.md, .cursorrules, CLAUDE.md, and mcp.json files directly into their local workspaces.

Unlike passive documentation, agent instruction files and MCP configurations are executable control planes. When an AI coding agent has bash and filesystem tool access, a malicious or compromised skill file can instruct the agent to read .env.local, exfiltrate credentials, or execute arbitrary shell commands.

The 12 Agent & MCP Threat Vectors in VibeShield v2.1

In VibeShield v2.1 (https://github.com/avivgerz-hue/vibe-shield), we built 12 static rules dedicated specifically to auditing AI agent configurations (VSB-MCP-001 through VSB-MCP-012) alongside our 80 Next.js, Supabase RLS, and TypeScript application security rules:

1. Zero-Width & Bidirectional Unicode Obfuscation: Detects invisible characters (U+200B, U+202E, etc.) hiding instructions inside SKILL.md or .cursorrules that do not appear in standard code review.
2. Prompt Override & Instruction Hijacking: Flags hidden directives instructing the agent to ignore prior safety boundaries or suppress warnings.
3. Credential & .env Exfiltration Directives: Catches skill instructions referencing .env, ~/.ssh, ~/.aws, or token files combined with outbound network tools (curl, wget, fetch).
4. Remote Shell Pipe Execution (curl | sh): Flags agent workflows or MCP hooks that pipe remote scripts directly into a shell.
5. Wildcard MCP Tool Permissions & Unpinned npx Servers: Audits mcp.json and .cursor/mcp.json for overly permissive flags (--allow-all, --dangerously-skip-permissions) or suspicious packages.

Scanning Any Repository in 3 Seconds

Before opening an unfamiliar repository in Cursor or Claude Code, run:

npx -y @vibefoundry/vibe-shield@latest scan .

You can also map the repository's complete attack surface (every public API route, webhook, database table, and agent skill file):

npx -y @vibefoundry/vibe-shield@latest surface .

Full Open-Source Verification Suite (MIT)

• 🛡️ VibeShield (92-Rule Security Scanner): https://github.com/avivgerz-hue/vibe-shield
• 👻 GhostQA (8-Trap Headless Playwright Browser QA): https://github.com/avivgerz-hue/ghost-qa
• 🎨 Unslop (72-Rule UI Craft & Contrast Auditor): https://github.com/avivgerz-hue/unslop