Complete earlier fixes and align the reader further with reference parsers

Five earlier review threads were addressed for the case raised but not
its neighbour. This commit closes them properly:

- InMemoryMcpSkillCatalog now hands out copies from ListAsync and GetAsync,
  not only on construction, so a mutated result cannot change later responses.
- URI validation decodes each path segment before checking for '.', '..',
  and separators, since System.Uri (and therefore the resource collection)
  treats "%2e%2e" as "..".
- An unterminated quoted scalar is malformed and no longer reaches the
  explicit-frontmatter escape hatch; a quote closed on a later line is
  still classified as unsupported multi-line YAML and remains bypassable.
- Directory loading reads each file with a buffer of the length it
  checked and fails if the file changed size, so a file growing between
  the check and the read can neither exceed the limit nor be served with
  a manifest that does not describe it.
- URI aliases that differ only in scheme or authority case are rejected
  even with identical content, because the resource collection would
  serve one resource whose contents carry the first URI, failing a
  verified read of the second.

Further alignment with reference YAML parsers, each confirmed against the
yaml npm package: plain mapping keys resolve like values ("TRUE:" is the
key "true", "0x10:" is "16"), flow mappings honour YAML's separator rules
("{version:1}" is the key "version:1" with a null value), a plain scalar
ended by a comment cannot continue on the next line, and only space and
tab are trimmed, so non-breaking spaces stay in scalars. Nesting is capped
at 32 levels so a hostile file cannot exhaust the stack.

Skill names accept Unicode lowercase and caseless letters, per the Agent
Skills wording "unicode lowercase alphanumeric characters". A test that
relied on reflection-based serialization now uses the SDK's options, so
the skills tests pass on net9.0 and net8.0 as well as net10.0.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6omaTvQiryHtzFHRqUE3b

Author: PederHP

docs/concepts/skills/skills.md

@@ -88,8 +88,8 @@ names containing characters with URI syntax (such as `{`, `?`, or a space) are p
 
 <xref:ModelContextProtocol.Extensions.Skills.SkillFrontmatter> reads the YAML frontmatter of a `SKILL.md` into a
 <xref:System.Text.Json.Nodes.JsonObject> without a YAML library. It accepts the subset of YAML that Agent Skills
-frontmatter uses: block mappings nested to any depth, block and flow sequences, plain, quoted, and block scalars,
-and comments. Unquoted scalars are resolved per the YAML 1.2 core schema (`null`, booleans, integers, finite
+frontmatter uses: block mappings (nested up to 32 levels), block and flow sequences, plain, quoted, and block
+scalars, and comments. Unquoted scalars are resolved per the YAML 1.2 core schema (`null`, booleans, integers, finite
 floats, otherwise strings), matching the YAML libraries used by other SDKs and by hosts. That matters because a
 host verifies a skill by parsing the fetched `SKILL.md` itself and comparing field by field against the published
 entry; a value that one side types as a number and the other as a string is a verification failure. Quote values

src/ModelContextProtocol.Extensions.Skills/Server/InMemoryMcpSkillCatalog.cs

@@ -11,8 +11,8 @@ namespace ModelContextProtocol.Extensions.Skills;
 /// so a server cannot publish an entry a conforming host would refuse to load.
 /// </para>
 /// <para>
-/// The catalog keeps its own copy of every entry, so later changes to the objects passed to the constructor do
-/// not affect what is served. Entries are ordered by URI so that pagination is stable across calls. Cursors are
+/// The catalog keeps its own copy of every entry and hands out copies, so neither later changes to the objects
+/// passed to the constructor nor changes to a returned entry affect what is served. Entries are ordered by URI so that pagination is stable across calls. Cursors are
 /// keyset cursors over that order rather than offsets.
 /// </para>
 /// <para>
@@ -91,7 +91,10 @@ public ValueTask<McpSkillPage> ListAsync(string? cursor, McpSkillRequestContext
         }
 
         var page = new Skill[count];
-        Array.Copy(_ordered, start, page, 0, count);
+        for (int i = 0; i < count; i++)
+        {
+            page[i] = SkillValidation.Snapshot(_ordered[start + i]);
+        }
 
         bool hasMore = start + count < _ordered.Length;
         return new ValueTask<McpSkillPage>(new McpSkillPage
@@ -112,8 +115,7 @@ public ValueTask<McpSkillPage> ListAsync(string? cursor, McpSkillRequestContext
 
         cancellationToken.ThrowIfCancellationRequested();
 
-        _byUri.TryGetValue(uri, out var skill);
-        return new ValueTask<Skill?>(skill);
+        return new ValueTask<Skill?>(_byUri.TryGetValue(uri, out var skill) ? SkillValidation.Snapshot(skill) : null);
     }
 
     private static string EncodeCursor(string uri) => Convert.ToBase64String(Encoding.UTF8.GetBytes(uri));

src/ModelContextProtocol.Extensions.Skills/Server/McpServerSkill.cs

@@ -484,11 +484,40 @@ private static void CollectFiles(string root, string directory, List<McpServerSk
             files.Add(new McpServerSkillFile
             {
                 Path = relativePath,
-                Content = File.ReadAllBytes(entry),
+                Content = ReadExactly(entry, length),
             });
         }
     }
 
+    /// <summary>
+    /// Reads a file whose length was checked against the per-skill limits a moment ago, allocating only that
+    /// length, and fails if the file turns out to be a different size, so a file that grows or shrinks between the
+    /// check and the read can neither exceed the limit nor be served with a manifest that does not describe it.
+    /// </summary>
+    private static byte[] ReadExactly(string path, long expectedLength)
+    {
+        var buffer = new byte[expectedLength];
+        using var stream = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.Read);
+        int total = 0;
+        while (total < buffer.Length)
+        {
+            int read = stream.Read(buffer, total, buffer.Length - total);
+            if (read == 0)
+            {
+                break;
+            }
+
+            total += read;
+        }
+
+        if (total != buffer.Length || stream.ReadByte() != -1)
+        {
+            throw new ArgumentException($"'{path}' changed size while it was being read.", "directoryPath");
+        }
+
+        return buffer;
+    }
+
     /// <summary>
     /// Percent-encodes each segment of a normalized relative path so that characters with URI syntax (such as
     /// <c>{</c>, <c>?</c>, <c>#</c>, or a space) in a file name stay literal. Without this, a file named

src/ModelContextProtocol.Extensions.Skills/Server/McpSkillsBuilderExtensions.cs

@@ -32,7 +32,8 @@ public static class McpSkillsBuilderExtensions
     /// </para>
     /// <para>
     /// Nested skills may legitimately list the same file. A file URI shared by several skills is registered once,
-    /// provided every skill lists it with the same digest.
+    /// provided every skill lists it with the same digest and the identical URI text. URIs that differ only in the
+    /// case of their scheme or authority are rejected, because the server's resource collection treats them as one.
     /// </para>
     /// <para>
     /// Every caller sees every skill. <c>skills/list</c> and <c>skills/get</c> are raw request handlers and do not
@@ -77,12 +78,20 @@ public static IMcpServerBuilder WithSkills(
                 var key = new Uri(entry.Uri, UriKind.Absolute);
                 if (registeredFiles.TryGetValue(key, out var existing))
                 {
+                    if (!string.Equals(existing.Uri, entry.Uri, StringComparison.Ordinal))
+                    {
+                        // Even with identical content the alias cannot be served: the collection registers one
+                        // resource, whose contents carry the first URI, so a verified read of the second fails.
+                        throw new ArgumentException(
+                            $"The file '{entry.Uri}' is equivalent to '{existing.Uri}', listed by another skill. Resource URIs are compared " +
+                            "case-insensitively in their scheme and authority, so the two would be served as one. Use identical URIs for a shared file.",
+                            nameof(skills));
+                    }
+
                     if (!string.Equals(existing.Digest, entry.Digest, StringComparison.Ordinal))
                     {
                         throw new ArgumentException(
-                            string.Equals(existing.Uri, entry.Uri, StringComparison.Ordinal)
-                                ? $"The file '{entry.Uri}' is listed by more than one skill with different content."
-                                : $"The file '{entry.Uri}' is equivalent to '{existing.Uri}', which another skill lists with different content. Resource URIs are compared case-insensitively in their scheme and authority.",
+                            $"The file '{entry.Uri}' is listed by more than one skill with different content.",
                             nameof(skills));
                     }