How We Security-Audit AI Agent Skills and MCP Servers
Why Security Auditing Matters for Agent Skills
As developers delegate more terminal commands, repository access, and system execution to autonomous coding assistants (such as Claude Code, Cursor, Windsurf, and Antigravity), agent tools have become a primary attack surface.
Installing an unvetted Model Context Protocol (MCP) server or executing an arbitrary command ruleset can expose local environment variables, credentials, and project files.
At Antigravity Skills, we enforce a strict static audit and permission boundary validation methodology before listing any skill. Here is how our security review process works and how you can evaluate skills in your own workflow.
1. Skill Type Classification & Execution Surface
Before auditing source code, we distinguish between three fundamentally different types of skills:
1. Instructional Skills (Prompt/Rule playbooks):
- Run purely in the language model's context window (e.g. SKILL.md or .cursorrules).
- Zero runtime daemons, no background network sockets, and no local process execution.
- Audited for prompt injection vectors, malicious instructions, and unintended file access suggestions.
2. Model Context Protocol (MCP) Servers:
- Run as standalone background processes (e.g. FastMCP via stdio or SSE transport).
- Audited for tool parameter validation, filesystem write scopes, and outbound network endpoints.
3. Standalone CLI Tools:
- Require explicit binary or script installation.
- Audited for dependency trees, supply chain integrity, and privilege requirements.
2. Our Five-Step Security Review Checklist
A. Repository & Commit Grounding
We never review arbitrary package names. Every audit is pinned to an official upstream Git repository, an explicit tag or 40-character commit SHA, and a verified inspection date.
B. Dependency & Supply Chain Verification
We inspect package.json, pyproject.toml, or build manifests. Unnecessary dependencies or obfuscated post-install scripts immediately trigger a rejection.
C. Environment Variable & Secret Hygiene
We verify that tools never log, transmit, or expose API keys (such as GOOGLE_API_KEY or GITHUB_TOKEN). Configuration must be injected strictly via standard client config files.
D. File System & Network Scopes
MCP servers that access files must enforce directory traversal checks and adhere to least-privilege principles. Outbound requests must point exclusively to documented, legitimate API endpoints.
E. Static Inspection Disclaimer
We maintain clear honesty: static inspection evaluates source code and configuration boundaries, but does not guarantee zero risk or replace isolated sandbox execution. We never claim an installation is "100% safe" without runtime constraints.