Developers using Claude Code, Cursor, Windsurf, and Cline regularly clone repositories or install community SKILL.md, .cursorrules, CLAUDE.md, and mcp.json files directly into their local workspaces.
Unlike passive documentation, agent instruction files and MCP configurations are executable control planes. When an AI coding agent has bash and filesystem tool access, a malicious or compromised skill file can instruct the agent to read .env.local, exfiltrate credentials, or execute arbitrary shell commands.
In VibeShield v2.1 (https://github.com/avivgerz-hue/vibe-shield), we built 12 static rules dedicated specifically to auditing AI agent configurations (VSB-MCP-001 through VSB-MCP-012) alongside our 80 Next.js, Supabase RLS, and TypeScript application security rules:
U+200B, U+202E, etc.) hiding instructions inside SKILL.md or .cursorrules that do not appear in standard code review..env Exfiltration Directives:~/.ssh, ~/.aws, or token files combined with outbound network tools ( curl, wget, fetch). curl | sh): npx Servers:mcp.json and .cursor/mcp.json for overly permissive flags (--allow-all, --dangerously-skip-permissions) or suspicious packages.
Before opening an unfamiliar repository in Cursor or Claude Code, run:
npx -y @vibefoundry/vibe-shield@latest scan .
You can also map the repository's complete attack surface (every public API route, webhook, database table, and agent skill file):
npx -y @vibefoundry/vibe-shield@latest surface .