Fix frontmatter depth-cap bypass and shell-quote server-supplied names in hints

CHANGELOG.md

@@ -37,7 +37,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Security
 
 - `skills-get --json` now returns only the content item it verified against the skill's manifest. A server whose `resources/read` answer carried extra items had them printed unverified alongside the verified one, under the same `contents` key an agent reads.
-- `skills-get` no longer hangs on a `SKILL.md` whose frontmatter has a long run of spaces inside a field name (the frontmatter parser walked such a line in quadratic time), and frontmatter nested deeper than 32 levels or indented inconsistently is now refused with a parse error instead of crashing or being silently truncated.
+- `skills-get` no longer hangs on a `SKILL.md` whose frontmatter has a long run of spaces inside a field name (the frontmatter parser walked such a line in quadratic time), and frontmatter nested deeper than 32 levels or indented inconsistently is now refused with a parse error instead of crashing or being silently truncated. The depth limit now also holds for a frontmatter that alternates `- key:` list items and nested lists, which used to slip past it and crash the CLI with a stack overflow.
+- The next-step hints printed by `skills-get`, `resources-directory-read` and `resources-read` now shell-quote the skill name and resource URIs they suggest running. Those values come from the server, so a skill named `pdf; curl … | sh #` used to yield a hint that ran the injected command when pasted or followed by an agent.
 - A bare `mcpc connect` no longer lets config files found in the current directory read environment variables. A `.mcp.json` checked into a repository could reference `${GITHUB_TOKEN}` in a header or hostname pointed at an attacker's server, and auto-discovery would have sent the secret on the first request. Such entries are now skipped with the variable names shown, `-H` is refused for auto-discovery (it would go to every discovered server), and connecting the file by name (`mcpc connect ./.mcp.json`) remains the explicit way to trust it. Config files under your home directory are unaffected.
 - Token refresh now goes only to the authorization server the profile logged in at, which `mcpc login` records, and never to a plaintext HTTP token endpoint. It used to re-resolve the server from the MCP server's metadata on every refresh, so a compromised server could point a session's refresh token and client secret at a server of its choosing. Profiles created before this release are pinned the next time you run `mcpc login`. (#387)
 - `mcpc login` no longer opens the authorization URL through `cmd.exe` on Windows. The URL comes from the authorization server, and `cmd.exe` treated `&`, `|`, `^` and `%VAR%` inside it as commands, so a malicious or compromised server could run arbitrary commands when you pressed Enter to open the browser (and even a benign URL was cut off at its first `&`). The browser is now launched without any shell on all platforms, and authorization URLs with a scheme other than `http:`/`https:` are refused.