@@ -254,8 +254,8 @@ Each response then holds at most 50 entries and carries a `nextCursor` while mor
 `SkillsClient.list_skills()` and `read_directory()` follow it for you. A skill entry is never split
 across pages.
 
-The cursor is opaque. One the catalog didn't issue is rejected with Invalid params (`-32602`), and
-so is any cursor when `page_size` isn't set. A `page_size` below 1 raises `ValueError`.
+The cursor is opaque. A cursor the catalog would not issue is rejected with Invalid params
+(`-32602`), and so is any cursor when `page_size` isn't set. A `page_size` below 1 raises `ValueError`.
 
 ### Invalid skills
 
@@ -310,9 +310,12 @@ or `..` segment, is listed more than once, or lies beneath another listed file.
 regardless of `strict`, because it indicates an error in the provider rather than in a skill.
 
 `FilesystemSkillProvider(root)` is the provider for a local directory. It serves regular files
-only. Symbolic links and Windows junctions are never followed: they are omitted, with a warning,
-when listing, and refused when read. A skill directory therefore cannot expose files outside
-itself. Blocking file system calls run in a worker thread.
+only. Symbolic links and Windows junctions found while listing are omitted, with a warning, and
+ones found while reading are refused, so a skill directory doesn't expose files outside itself.
+
+The root is trusted. This is a best-effort check, not a defence against someone who can modify the
+directory while the server runs. As a backstop, the catalog refuses to serve any file whose bytes
+no longer match the digest taken at `load()`. Blocking file system calls run in a worker thread.
 
 ## Protocol version and caching
 
 
@@ -18,6 +18,10 @@
 _READ_FLAGS = os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0) | getattr(os, "O_BINARY", 0) | getattr(os, "O_NONBLOCK", 0)
 
 
+# Windows reads `\` as a separator and `:` as drive syntax, so a "/"-only check lets `..\x` or `C:x` leave the root.
+# On POSIX both are ordinary file name characters.
+_FORBIDDEN_SEGMENT_CHARS = "\\:" if os.name == "nt" else ""
+
 # Windows junctions and symlinks are reparse points tagged IO_REPARSE_TAG_MOUNT_POINT / IO_REPARSE_TAG_SYMLINK,
 # constants that `stat` only types on Windows. Other reparse points (cloud placeholders, dedup) are ordinary files.
 _WINDOWS_LINK_REPARSE_TAGS = frozenset({0xA0000003, 0xA000000C})
@@ -53,12 +57,16 @@ async def read_file(self, path: str) -> bytes:
         """Return the bytes of the regular file at `path`, relative to the root.
 
         Raises:
-            ValueError: If `path` has an empty, `.` or `..` segment.
+            ValueError: If `path` has an empty, `.` or `..` segment, or, on Windows, a segment
+                containing `\\` or `:`.
             OSError: If the file is missing, can't be read, is a symlink, or isn't a
                 regular file, or if a directory on the way to it is a symlink.
         """
         segments = path.split("/")
-        if any(segment in ("", ".", "..") for segment in segments):
+        if any(
+            segment in ("", ".", "..") or any(char in segment for char in _FORBIDDEN_SEGMENT_CHARS)
+            for segment in segments
+        ):
             raise ValueError(f"invalid skill file path {path!r}")
         return await anyio.to_thread.run_sync(self._read_file, segments)
 
 
@@ -16,9 +16,10 @@ class SkillProvider(Protocol):
     """
 
     async def list_files(self) -> Sequence[str]:
-        """Return the path of every file, recursively.
+        """Return the path of every file the provider serves, recursively.
 
-        Directories are not listed, and each path appears once.
+        Directories are not listed, and each path appears once. A provider may leave files out;
+        `FilesystemSkillProvider` omits any name that starts with `.`.
         """
         ...
 
 
@@ -22,6 +22,7 @@
 # bodies are excluded from coverage by a pragma on each decorator.
 requires_file_symlinks = pytest.mark.skipif(sys.platform == "win32", reason="needs symlink privilege")
 requires_fifos = pytest.mark.skipif(not hasattr(os, "mkfifo"), reason="POSIX-only")
+requires_posix_names = pytest.mark.skipif(sys.platform == "win32", reason="Windows forbids `\\` and `:` in names")
 
 IO_REPARSE_TAG_MOUNT_POINT = 0xA0000003
 IO_REPARSE_TAG_SYMLINK = 0xA000000C
@@ -199,6 +200,34 @@ async def test_read_file_rejects_empty_dot_and_dot_dot_segments(tmp_path: Path,
         await FilesystemSkillProvider(tmp_path).read_file(path)
 
 
+@pytest.mark.parametrize("path", ["..\\secret.txt", "skill\\SKILL.md", "C:secret.txt", "skill/C:SKILL.md"])
+async def test_read_file_refuses_windows_path_syntax_that_could_leave_the_root(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, path: str
+) -> None:
+    """SDK-defined: on Windows `\\` separates and `:` names a drive, so a "/"-only check would let these escape.
+
+    The Windows rule is switched on here because the escape can't be shown from a POSIX path.
+    """
+    root = tmp_path / "root"
+    root.mkdir()
+    (tmp_path / "secret.txt").write_bytes(b"outside the root")
+    monkeypatch.setattr("mcp.server.skills.filesystem._FORBIDDEN_SEGMENT_CHARS", "\\:")
+
+    with pytest.raises(ValueError):
+        await FilesystemSkillProvider(root).read_file(path)
+
+
+@requires_posix_names  # pragma: lax no cover
+async def test_names_containing_a_colon_or_backslash_are_served_off_windows(tmp_path: Path) -> None:
+    """SDK-defined: `:` and `\\` are ordinary name characters on POSIX, so the Windows rule must not reject them."""
+    (tmp_path / "skill").mkdir()
+    (tmp_path / "skill" / "a:b\\c.md").write_bytes(b"content")
+    provider = FilesystemSkillProvider(tmp_path)
+
+    assert await provider.list_files() == ["skill/a:b\\c.md"]
+    assert await provider.read_file("skill/a:b\\c.md") == b"content"
+
+
 async def test_read_file_raises_os_error_for_a_missing_file(tmp_path: Path) -> None:
     with pytest.raises(OSError):
         await FilesystemSkillProvider(tmp_path).read_file("missing.md")