Author
Tobias Lindqvist-Rao
Technical deep-diver · threat.cafe editorial persona
Fictional profile.
Tobias reads vendor documentation and incident timelines line by line to find where agent security controls fail open, and writes up each failure with a reproducible test. A fictional writer persona; articles are researched and fact-checked by the threat.cafe editors.
Writes on
- threat.cafe 10
10 posts
-
Skills inherit everything your agent can touch: scoping credentials and shell access per skill and MCP server
A skill or local MCP server runs with the agent's environment, files and network. The working least-privilege unit is the credential and command surface each one can reach, set in sandbox, permission and server config, not in the prompt.
-
Markdown is executable now: why SKILL.md instructions slip past code scanners, and what a skill review must actually read
A skill's behaviour lives in its prose, its frontmatter and its load-time commands, not only its scripts. Code scanners read the scripts. This one-page rubric reviews the rest as code.
-
Five Claude Code hook settings that quietly turn agent enforcement into advice
Exit 1 does not block. A timed-out hook does not block. The if filter is best-effort. Plugin tools carry prefixed names. User hooks merge in unless managed-only mode is on. Check all five before you call a hook a control.
-
Do coding agents call optional security tools on their own? What the docs guarantee, and a 50-task test to run
Nothing in the MCP spec or Claude Code's docs makes an agent call a security-check tool before it installs something. The model decides. Here is why, and a pre-registered 50-task protocol to measure it on your own setup.
-
Skill scanning in Claude Enterprise skips API uploads, pre-existing skills and ZDR orgs: closing the gaps
Claude Enterprise skill scanning checks new uploads and edits in claude.ai and Cowork. Anthropic's docs say it skips Skills API uploads, pre-existing skills, and CMEK, ZDR and HIPAA-ready orgs. A control for each gap.
-
The axios compromise from an agent operator's seat: which controls would have fired, and when
Replaying the 31 March 2026 axios timeline against seven controls: a release-age delay and install-script blocking covered the whole window, a provenance check caught one of two versions, and advisories came at removal.
-
A classifier that misses 17% of overeager actions: layering model-based approval over deterministic deny rules
Anthropic's auto-mode classifier misses 17% of real overeager actions in its own evaluation. It is a good middle layer. Known-bad artifacts, credential reads and irreversible actions need rules that never consult it.
-
The agent decision log: what auditors, insurers and incident responders will ask your coding agents to prove
After an agent incident, everyone asks what was installed or fetched, under which policy, and who approved it. A minimum log schema, mapped to hook and telemetry fields, lets you answer with a query.
-
Where should an agent artifact check run? Hook vs package wrapper vs gateway vs registry, by what each can see
Each enforcement point sees a different slice. Hooks see agent tool calls, wrappers see package resolution, gateways see network traffic, registries see uploads. Place checks by the artifacts and failure modes you actually face.
-
After NVD's triage: what a 2026 CVE record still carries, and how small teams rebuild triage for free
In a sample of 890 CVE records published in 2026, 96% carried a CVSS score from the CNA or CISA, but under 10% carried a CPE string. Severity mostly survived NVD's triage. Product matching did not. Here is the free rebuild.
