How to Audit Third-Party SKILL.md, .cursorrules, and mcp.json Files for Prompt Injection and Exfiltration

The VibeShield project released v2.1, a scanner that adds 12 static rules (VSB-MCP-001 through VSB-MCP-012) for auditing AI agent configuration files such as SKILL.md, .cursorrules, CLAUDE.md, and mcp.json. The tool targets prompt injection and credential exfiltration risks in agent instruction files, flagging hidden Unicode characters, .env and SSH/AWS exfiltration directives, curl-pipe-shell commands, and overly permissive MCP server flags. It ships alongside 80 existing Next.js, Supabase RLS, and TypeScript security rules and is runnable via npx.

Developers using Claude Code, Cursor, Windsurf, and Cline regularly clone repositories or install community SKILL.md , .cursorrules , CLAUDE.md , and mcp.json files directly into their local workspaces. Unlike passive documentation, agent instruction files and MCP configurations are executable control planes . When an AI coding agent has bash and filesystem tool access, a malicious or compromised skill file can instruct the agent to read .env.local , exfiltrate credentials, or execute arbitrary shell commands. In VibeShield v2.1 https://github.com/avivgerz-hue/vibe-shield https://github.com/avivgerz-hue/vibe-shield , we built 12 static rules dedicated specifically to auditing AI agent configurations VSB-MCP-001 through VSB-MCP-012 alongside our 80 Next.js, Supabase RLS, and TypeScript application security rules: U+200B , U+202E , etc. hiding instructions inside SKILL.md or .cursorrules that do not appear in standard code review. .env Exfiltration Directives: ~/.ssh , ~/.aws , or token files combined with outbound network tools curl , wget , fetch . curl | sh : npx Servers: mcp.json and .cursor/mcp.json for overly permissive flags --allow-all , --dangerously-skip-permissions or suspicious packages. Before opening an unfamiliar repository in Cursor or Claude Code, run: npx -y @vibefoundry/vibe-shield@latest scan . You can also map the repository's complete attack surface every public API route, webhook, database table, and agent skill file : npx -y @vibefoundry/vibe-shield@latest surface .