agent-skill-auditorlisted

# Agent Skill Auditor ## Purpose Agents cannot reliably separate *instructions* from *data*. Any text an extension carries — including characters that render as nothing on screen — can be read by the model as a command. This skill runs `uncloak`, a zero-dependency static scanner, over an untrusted Agent Skill, MCP tool definition, or rules file **before** it is installed or enabled, so hidden instructions and supply-chain traps are surfaced while you can still say no. `uncloak` decodes what a human review misses (Unicode Tags-block smuggling, zero-width characters, bidi/Trojan-Source, variation-selector channels, homoglyphs), flags dangerous intent (instruction override, "don't tell the user" stealth, MCP tool poisoning, trigger-conditioned rug-pulls, credential/exfil access, pipe-to-shell), and maps each finding to **OWASP LLM Top 10 (2025)** and **MITRE ATLAS** with a stable `UCxxx` rule id. This is one static layer, not a safety proof. It complements — does not replace — provenance/signing, sandboxing, and egress allowlists. ## When to use Invoke this skill whenever you are about to trust new agent-facing text, specifically: - Installing or enabling a **Claude / agent Skill** (a `SKILL.md` + its folder). - Adding an **MCP server** to `claude_desktop_config.json`, `.mcp.json`, or equivalent — tool *descriptions* are model-visible and are a poisoning surface. - Adopting a **rules file**: `CLAUDE.md`, `AGENTS.md`, `.cursorrules`, `.windsurfrules`, Copilot instructi