security: scan rendered MCP prompts by trust tier

[Aaronontheweb]

Problem

PR #1813 adapts MCP prompts into dynamic skills.

An MCP server grant authorizes access to the server. It does not guarantee that each rendered prompt contains safe model guidance.

The current ISkillContentScanner runtime registration uses NoOpSkillContentScanner. The regex scanner remains disabled because it rejects valid operations documentation.

Calling the current scanner for MCP prompts would imply protection that the runtime does not provide.

Proposed direction

Define an explicit content trust tier at the skill scan boundary.

Treat a rendered MCP prompt as remote instructions. Apply a scanner policy that can differ from trusted local skill files.

Reuse IPromptInjectionDetector and the existing scan verdict model. Do not add another MCP permission system.

Acceptance criteria

• The scan boundary distinguishes trusted local files, remote skill content, and rendered MCP prompts.
• The runtime scans the full attributed MCP prompt result before it returns remote instructions to the model.
• A high-risk verdict blocks the rendered prompt.
• A warning verdict remains visible with the attributed prompt.
• A scanner failure uses an explicit fail-closed policy for rendered MCP prompts.
• Tests cover allowed, warning, rejected, failed, and cancelled scans.
• Tests prove that the MCP server grant remains separate from the content verdict.
• The design addresses known false positives before the runtime enables enforcement.

Related work

• Epic Epic: Make skills discoverable and directly invocable #1805
• Prompt skill implementation feat(mcp): expose server prompts as dynamic skills #1813
• MCP prompt issue Expose MCP prompts as transient Netclaw skills #1806