# How to Audit Third-Party SKILL.md, .cursorrules, and mcp.json Files for Prompt Injection and Exfiltration

> Source: <https://dev.to/avivgerzhue/how-to-audit-third-party-skillmd-cursorrules-and-mcpjson-files-for-prompt-injection-and-4g30>
> Published: 2026-11-13 21:12:51+00:00

Developers using Claude Code, Cursor, Windsurf, and Cline regularly clone repositories or install community `SKILL.md`, `.cursorrules`, `CLAUDE.md`, and `mcp.json` files directly into their local workspaces.

Unlike passive documentation, **agent instruction files and MCP configurations are executable control planes**. When an AI coding agent has bash and filesystem tool access, a malicious or compromised skill file can instruct the agent to read `.env.local`, exfiltrate credentials, or execute arbitrary shell commands.

In **VibeShield v2.1** ([https://github.com/avivgerz-hue/vibe-shield](https://github.com/avivgerz-hue/vibe-shield)), we built 12 static rules dedicated specifically to auditing AI agent configurations (`VSB-MCP-001` through `VSB-MCP-012`) alongside our 80 Next.js, Supabase RLS, and TypeScript application security rules:

`U+200B`, `U+202E`, etc.) hiding instructions inside `SKILL.md` or `.cursorrules` that do not appear in standard code review.`.env` Exfiltration Directives:`~/.ssh`, `~/.aws`, or token files combined with outbound network tools (` curl`, `wget`, `fetch`).` curl | sh`):` npx` Servers:`mcp.json` and `.cursor/mcp.json` for overly permissive flags (`--allow-all`, `--dangerously-skip-permissions`) or suspicious packages.
Before opening an unfamiliar repository in Cursor or Claude Code, run:

`npx -y @vibefoundry/vibe-shield@latest scan .`

You can also map the repository's complete attack surface (every public API route, webhook, database table, and agent skill file):

`npx -y @vibefoundry/vibe-shield@latest surface .`