{"slug": "how-to-audit-third-party-skill-md-cursorrules-and-mcp-json-files-for-prompt-and", "title": "How to Audit Third-Party SKILL.md, .cursorrules, and mcp.json Files for Prompt Injection and Exfiltration", "summary": "The VibeShield project released v2.1, a scanner that adds 12 static rules (VSB-MCP-001 through VSB-MCP-012) for auditing AI agent configuration files such as SKILL.md, .cursorrules, CLAUDE.md, and mcp.json. The tool targets prompt injection and credential exfiltration risks in agent instruction files, flagging hidden Unicode characters, .env and SSH/AWS exfiltration directives, curl-pipe-shell commands, and overly permissive MCP server flags. It ships alongside 80 existing Next.js, Supabase RLS, and TypeScript security rules and is runnable via npx.", "body_md": "Developers using Claude Code, Cursor, Windsurf, and Cline regularly clone repositories or install community `SKILL.md`, `.cursorrules`, `CLAUDE.md`, and `mcp.json` files directly into their local workspaces.\n\nUnlike passive documentation, **agent instruction files and MCP configurations are executable control planes**. When an AI coding agent has bash and filesystem tool access, a malicious or compromised skill file can instruct the agent to read `.env.local`, exfiltrate credentials, or execute arbitrary shell commands.\n\nIn **VibeShield v2.1** ([https://github.com/avivgerz-hue/vibe-shield](https://github.com/avivgerz-hue/vibe-shield)), we built 12 static rules dedicated specifically to auditing AI agent configurations (`VSB-MCP-001` through `VSB-MCP-012`) alongside our 80 Next.js, Supabase RLS, and TypeScript application security rules:\n\n`U+200B`, `U+202E`, etc.) hiding instructions inside `SKILL.md` or `.cursorrules` that do not appear in standard code review.`.env` Exfiltration Directives:`~/.ssh`, `~/.aws`, or token files combined with outbound network tools (` curl`, `wget`, `fetch`).` curl | sh`):` npx` Servers:`mcp.json` and `.cursor/mcp.json` for overly permissive flags (`--allow-all`, `--dangerously-skip-permissions`) or suspicious packages.\nBefore opening an unfamiliar repository in Cursor or Claude Code, run:\n\n`npx -y @vibefoundry/vibe-shield@latest scan .`\n\nYou can also map the repository's complete attack surface (every public API route, webhook, database table, and agent skill file):\n\n`npx -y @vibefoundry/vibe-shield@latest surface .`", "url": "https://wpnews.pro/news/how-to-audit-third-party-skill-md-cursorrules-and-mcp-json-files-for-prompt-and", "canonical_source": "https://dev.to/avivgerzhue/how-to-audit-third-party-skillmd-cursorrules-and-mcpjson-files-for-prompt-injection-and-4g30", "published_at": "2026-11-13 21:12:51+00:00", "updated_at": "2026-11-13 21:21:21.664594+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "developer-tools", "agent-protocols", "ai-tools"], "entities": ["VibeShield", "Claude Code", "Cursor", "Windsurf", "Cline", "Supabase", "Next.js", "VibeFoundry"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/how-to-audit-third-party-skill-md-cursorrules-and-mcp-json-files-for-prompt-and", "markdown": "https://wpnews.pro/news/how-to-audit-third-party-skill-md-cursorrules-and-mcp-json-files-for-prompt-and.md", "text": "https://wpnews.pro/news/how-to-audit-third-party-skill-md-cursorrules-and-mcp-json-files-for-prompt-and.txt", "jsonld": "https://wpnews.pro/news/how-to-audit-third-party-skill-md-cursorrules-and-mcp-json-files-for-prompt-and.jsonld"}}