Governance and Security of Agent Configuration Files, Skills, Plugins, and MCP

A Systematic Literature Review (SLR) of the concepts, frameworks, and case studies for protecting against the security and privacy risks introduced by a new class of AI-agent artifacts: instruction/configuration files (AGENTS.md, CLAUDE.md, .cursor/rules, SKILL.md), modular skills and plugins, and the tool-integration layer standardized by the Model Context Protocol (MCP).

This repository bundles the review itself, a companion datasets catalog, the primary sources, downloadable copies of the released datasets/benchmarks, and a full audit trail of the agent sessions that produced the work.

---

Contents

---

Provenance & reproducibility

Every empirical claim in the review was checked directly against the source PDFs in outputs/agent-governance-papers/, and published DOIs were verified via Crossref. The datasets in outputs/agent-governance-datasets/ were obtained from their upstream sources with the scripts in outputs/.

Stripped Git history, preserved provenance. The dataset folders were originally git cloned or downloaded as review artifacts. To keep this archive lightweight, nested .git directories have been removed. In their place, each of the 16 folders carries a PROVENANCE.md recording the exact source URL, the pinned upstream commit (for Git sources), the retrieval date, and the retrieval method — so every snapshot remains fully traceable and reproducible.

To restore any dataset to its full upstream history, follow the clone/checkout command in that folder's PROVENANCE.md, or re-run outputs/download_datasets.sh.

Notable dataset caveats (see the catalog for the full picture)

• A7 Connor — the ~503 MB Dataset/Benign/benign_servers.zip exceeds GitHub's 100 MB per-file limit and is excluded from this mirror (.gitignored). Retrieve it from the upstream repo at the pinned commit in its PROVENANCE.md.
• A8 mcp_priv — the downloaded copy is the detector only (CodeQL queries + PII sample servers + scan scripts); the 10,655-server corpus is withheld until after review.
• B6 ShadowCodeEPI — the upstream repo is currently a placeholder (README only); code/data will be released upon paper acceptance.
• B2 AIShellJack — the large raw_results.zip (~1.68 GB) was intentionally not downloaded; fetch it from the figshare record if needed.

---

Reproduce from scratch

# 1. Re-download the 28 source PDFs
bash outputs/download_papers.sh

# 2. Re-download the 16 downloadable datasets/benchmarks
bash outputs/download_datasets.sh

Both scripts are idempotent (they skip anything already present) and require only git + curl (plus optional python3 for the figshare package).

---

Scope & method

• Sources: peer-reviewed academic papers and arXiv preprints, balanced 2023–2026 coverage, 28 verified entries organized into four tracks.
• Verification: first-page title/author/arXiv-ID blocks and every headline statistic were extracted from each PDF and cross-checked; published DOIs were resolved via the Crossref API.
• Key gap surfaced: there is solid work on detecting and architecturally containing these risks, but essentially no peer-reviewed framework for the provenance, integrity, and vetting of agent instruction files by name (AGENTS.md / CLAUDE.md) — a live opportunity for original contribution.

---

Licensing note

This repository aggregates third-party research artifacts for review purposes. Each dataset folder retains its upstream LICENSE where one was provided; refer to each PROVENANCE.md and the upstream source for citation and reuse terms. The source PDFs remain under their respective publishers'/authors' copyright and are included here solely to support verification of the review.