[tsarlandie-oai]

Motivation and context

Skill::validate compares a URI segment with the UTF-8 name from SKILL.md frontmatter. A skill named café therefore fails validation with NameMismatch when a server advertises skill://caf%C3%A9/SKILL.md. This came up while reviewing the filesystem catalog in #1409 and also affects servers that construct their own entries.

Percent-decode the name segment once and compare it with the frontmatter using the NFKC form used by the Agent Skills reference validator. Enforce the 1–64 character limit and allow lowercase letters, letters from scripts without case, numbers, and single internal hyphens. Invalid names now produce a distinct validation error. Agent Skills naming rules

When checking a listing for duplicate entries, use the same percent-encoding normalization as the manifest checker. This catches equivalent spellings of a skill URI while preserving the advertised URI for reads.

Tests

• Reproduced NameMismatch on main with the new Unicode regression test. The fix accepts top-level and nested names with either hex case. Tests also cover invalid UTF-8, double encoding, and an encoded slash.
• A list containing equivalent URI spellings now returns DuplicateSkill. The regression test covers the hex case, an escaped unreserved character, and a literal Unicode name.
• Tests cover the 64/65-character boundary, uncased scripts, invalid name syntax, and composed and decomposed Unicode spellings. cargo test -p rmcp --lib --no-default-features passed all 193 tests.
• cargo test -p rmcp --features client --test test_skills passed all 14 tests.
• cargo clippy -p rmcp --lib --no-default-features -- -D warnings and cargo +nightly fmt --all -- --check passed.
• Tested locally together with the filesystem catalog from feat: load skills from a directory tree #1409 and its follow-up fix(skills): prevent symlink swaps during catalog loads #1438. All 30 catalog tests passed. A separate test verified that a real café/SKILL.md appears under the encoded URI and returns the original Markdown through read_resource.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-07T06:05:06.645957Z	793e02a	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

@jamadeo is on triage rotation this week and is the reviewer for this one.

Labels come from the PR labeler. Please review the change.

_{Automated triage. Labels are a first pass and the assigned maintainer has the final say.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 94982693ab

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[DaleSeo]

Thanks for chasing this down, @tsarlandie-oai!

[jokemanfire]

The parsing side looks right to me, and I checked the parts that are easy to get subtly wrong:

• the hyphen state machine rejects -two, two-, two--words and accepts 東京-٢, which is what the reference validator does;
• decode_utf8() makes invalid escapes (r%FFsum) fail closed as NameMismatch instead of falling back to the raw segment;
• normalizing both sides with NFKC handles the composed/decomposed pair (re%CC%81sume%CC%81 vs résumé);
• validate_skills normalizes the URI before the duplicate check, so %72 / lowercase-hex / literal-Unicode aliases are caught.

Three questions before this lands:

1. Which string does the 64-character limit apply to? is_valid_skill_name counts characters after .nfkc(), while the stored name is the raw frontmatter string. A 100-character name that NFKC-composes below 64 would pass while the manifest still carries 100 characters — and any consumer that re-validates the raw string will disagree. Either count the raw chars() (and separately bound the normalized form), or state explicitly that the limit is on the normalized form.

2. Three unconditional dependencies. mod skill is not feature-gated, so percent-encoding, unicode-general-category (a full Unicode table) and unicode-normalization land on every rmcp build, including servers that never touch skills. If that is intentional, fine — but it is a measurable binary/count bump, so it deserves a line in the PR description or a gate behind the skills feature.

3. NFKC equality accepts aliases. With this change, skill://ｃａｆｅ/SKILL.md validates against a frontmatter name of cafe. That is the reference validator's behavior, but the URI is what clients fetch and log, so a server can advertise a confusable spelling for a name clients will render as ASCII. If you want that closed, the cheap version is to require the decoded segment to equal the name exactly after canonicalization on the emitting side, rather than accepting any NFKC-equivalent spelling on the receiving side.

Minor: the InvalidName message says "1–64 characters" while the check is on the normalized form; align the wording with whichever answer (1) gets.