auditing-skill-and-mcp-instructions

# Auditing skill and MCP instructions: the markdown is the attack surface Most reviews read a skill or an MCP server as code and skim the prose. But the prose is what the model obeys. A skill body, a tool description, a parameter hint: the model reads all of it as instruction, not as documentation. That makes the instruction text a first-class injection surface, and it is the one almost every tool ignores because scanners lint code, not markdown. This skill lints the words. ## When to use - You are reviewing a skill, an MCP server, or a marketplace entry before trusting it. - You want to know what instruction text will enter an agent's context on load. - You are triaging a skill that behaves in a way its visible instructions do not explain. ## Scope check Audit skills and servers you own or are authorized to review, on your own agent. Do not install untrusted artifacts outside a contained test. If you can't name the authorization, stop. ## The loop 1. **Gather the full instruction surface as the model sees it.** Collect every text the model actually reads: the skill body, the frontmatter description, each tool's name and description, parameter schemas and hints, and any prompt or context file the artifact loads. This is model input, not docs. Work from the exact bytes, not a rendered view. 2. **Normalize and reveal the hidden layers.** Strip and expand markup so nothing stays folded: comments, collapsed regions, zero-size or off-screen text, and meta...