The 15 rules, and the official rule behind each

What it looks for. An entry with no publisher, no registry page and no source URL, or a command that fetches an unqualified package from a public registry.

Why it matters. A skill or server is code from a stranger that the agent will run with your credentials. The episode calls skills and MCP servers the new npm: the same trust problem as a dependency, with more access. If you cannot name the publisher and the page you checked, you have not reviewed it.

What it looks for. A missing version, latest, a star or range, a branch name, a floating Docker tag, or a bare npx or uvx package with no exact version.

Why it matters. Approval is a statement about a version, not a name. A tag that moves, a branch that advances or a registry package that publishes again turns a reviewed server into an unreviewed one. The MCP guidance calls this the rug pull: the definition changes after the user approved it.

What it looks for. An http:// URL that is not loopback, a remote transport with no TLS, or a flag that permits plain HTTP.

Why it matters. A remote server carries tool arguments and results, which routinely include paths, records and tokens. The MCP security guidance requires TLS for remote Streamable HTTP and rejects a downgrade to plain HTTP. A plain endpoint is a readable audit trail for anyone on the path.

What it looks for. A filesystem permission of /, ~, the home directory, a whole drive or a recursive wildcard, or instructions that read ~/.ssh, ~/.aws, .env or browser profiles.

Why it matters. A whole-disk or home-directory grant puts SSH keys, cloud credentials and every repository in reach of an instruction file. The OWASP MCP guidance names sandbox escapes and credential theft as the consequence of local servers with full host access, and the ToxicSkills audit found credential theft in confirmed malicious skills.

What it looks for. A network permission of any, all, a wildcard, 0.0.0.0/0, or no allowlist at all, or instructions that post to a webhook or an unknown host.

Why it matters. Open egress is the channel an exfiltration needs. The episode describes enterprises locking agents out of the open internet and curating what they can reach; a skill with unrestricted network access has the channel even if today's instructions look harmless.

What it looks for. curl piped to a shell, eval, base64 decoding into a command, chmod +x on a download, a password-protected archive, powershell encoded commands, or os.system and subprocess calls in the skill body.

Why it matters. This is the exact shape of the malicious skills the ToxicSkills audit confirmed: installation instructions that download a password-protected archive, decode an obfuscated command and run it. Three lines of English can be malware, and the agent will follow them without the hesitation a person would show.

What it looks for. An entry with no sandbox field, sandbox false or none, a bare npx or uvx launched on the host, or a container configured with host networking or a host mount.

Why it matters. A local server runs as you. The episode describes the common enterprise setup as skills scanning and MCP scanning, a secure Docker sandbox and separate identities; without the sandbox, a compromised server has your files, your network and your tokens.

What it looks for. The same token, API key, service account or identity value used by two or more entries, an entry that declares a shared identity, or instructions that say to use the shared credential.

Why it matters. A shared identity makes every action look like every other agent, so the log cannot tell you who did it and revoking one agent revokes all of them. The episode puts separate identities for agents in the same sentence as the sandbox: everyone is a teammate with their own identity.

What it looks for. A name on the confirmed-malicious list, a name one or two edits from a popular package but not equal to it, an impersonated scope, or a package that borrows an official-looking prefix.

Why it matters. Slopsquatting and typosquatting work because the name is close enough to pass a glance. The ToxicSkills audit confirmed 76 malicious payloads and found 8 still live at publication; the attack starts with a name the agent or the developer accepts.

What it looks for. An entry with no logging or audit field, logging false or none, no destination, or no retention period.

Why it matters. Without a record of what the agent called and with which arguments, an investigation has nothing to read. The MCP guidance is explicit that token passthrough breaks the audit trail because the server cannot tell clients apart; a shared identity makes it worse, and no log makes it impossible.

What it looks for. Ignore previous instructions, do not tell the user, system message impersonation, hidden HTML comments, base64 or Unicode obfuscation, or instructions to disable a safety control.

Why it matters. The skill's intent is a security question in its own right. ToxicSkills found prompt injection among the most prevalent categories, including hidden instructions in obfuscated formats and system message impersonation, and a skill can perform its stated job while doing something else.

What it looks for. A tool that deletes, drops, truncates, overwrites or writes to production, a destructive hint set to true, or a permission mode that skips confirmation.

Why it matters. The PocketOS incident in the episode is the case: an agent that was overly permissioned deleted a production database and then said it should not have done that. A manifest is where that permission is visible before the incident, and the review is cheap now.

What it looks for. An env value that matches a key or token shape, a literal password, a bearer token or a private key block.

Why it matters. ToxicSkills found hardcoded secrets in 34 skills and in 32 percent of the confirmed malicious samples. A config file is copied into repositories, screenshots and tickets; a secret in it is a secret you have already lost.

What it looks for. Auto-approve true, approval never, bypassPermissions, --dangerously-skip-permissions, or instructions that say not to ask for confirmation.

Why it matters. The MCP guidance says to require explicit confirmation for destructive, financial or data-sharing operations and never to auto-approve tool calls. The agent follows instructions without reluctance, which is the strength and the risk.

What it looks for. A skill that fetches web pages, email, issues or social content and also has write access, network access or a credential, the toxic-flow combination.

Why it matters. A skill that reads untrusted content and can act on it lets an attacker who can edit that content give the agent orders. The ToxicSkills audit found 17.7 percent of skills fetching untrusted content, and the combination of private data, untrusted content and an outbound channel is the lethal trifecta.