[SergeyMenshykh]

Motivation & Context

Strengthen MCP skill resource-name validation while preserving supported resource identifiers and URI schemes

Description & Review Guide

• What are the major changes? Refine internal resource-name handling, update documentation, and expand unit coverage.
• What is the impact of these changes? No public API changes. Existing MCP resource schemes remain supported.
• What do you want reviewers to focus on? Cross-language consistency, compatibility, and test coverage.

Related Issue

N/A.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

Copilot review overview

🟡 Changes recommended

Critical encoded-delimiter traversal bypasses and additional URI/path validation issues remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 2 · 1

Open (3)

• Prevent encoded delimiters from hiding path traversal · New
• Prevent encoded delimiters from hiding path traversal · New
• Use normalized resource names when constructing request URIs · New

What changed in this PR

Improves MCP skill resource-name validation across .NET and Python while preserving supported URI schemes.

Changes:

• Adds layered decoding and unsafe-path validation.
• Expands cross-language tests and documentation.
• Adds .NET rejection logging.

File	Description
python/​packages/​core/​tests/​core/​test_mcp_skills.py	Expands validation and URI-scheme tests.
python/​packages/​core/​agent_framework/​_skills.py	Implements layered resource-name validation.
dotnet/​tests/​Microsoft.Agents.AI.Mcp.UnitTests/​Skills/​AgentMcpSkillsSourceTests.cs	Adds equivalent .NET test coverage.
dotnet/​src/​Microsoft.Agents.AI.Mcp/​Skills/​Loaders/​SkillMdEntryLoader.cs	Propagates logging to MCP skills.
dotnet/​src/​Microsoft.Agents.AI.Mcp/​Skills/​AgentMcpSkillsSource.cs	Documents resource security behavior.
dotnet/​src/​Microsoft.Agents.AI.Mcp/​Skills/​AgentMcpSkill.cs	Adds validation and rejection logging.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): e11dc4a66efb
Model: gpt-5.6-sol-fast

Overview

The PR adds cross-language validation for absolute paths, traversal at multiple percent-encoding depths, embedded URI forms, and control characters, with permissive-server tests confirming rejected names never reach the MCP transport. It also preserves valid resource identifiers and root schemes. Two gaps remain: encoded delimiters can hide encoded traversal from the segment check, and recursively decoding without a bound permits request-local CPU exhaustion.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
2 verified findings remained after source verification (2 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: dotnet/src/Microsoft.Agents.AI.Mcp/Skills/AgentMcpSkill.cs

[Eduard van Valkenburg (eavanvalkenburg)]

LGTM for Python