Tag
#agent-skills
10 posts
-
Skills inherit everything your agent can touch: scoping credentials and shell access per skill and MCP server
A skill or local MCP server runs with the agent's environment, files and network. The working least-privilege unit is the credential and command surface each one can reach, set in sandbox, permission and server config, not in the prompt.
-
Markdown is executable now: why SKILL.md instructions slip past code scanners, and what a skill review must actually read
A skill's behaviour lives in its prose, its frontmatter and its load-time commands, not only its scripts. Code scanners read the scripts. This one-page rubric reviews the rest as code.
-
Popular isn't vetted: install counts, stars and 'official-looking' names are the signals attackers fake first
Documented agent-ecosystem attacks faked forks and contributors, borrowed vendor names and topped AI search results. Rank trust signals by how cheaply they can be forged, and let audit and provenance outrank popularity.
-
OWASP's two agent Top 10s, ASI and AST, mapped to controls you can actually test
OWASP's Agentic Applications list (ASI) and its incubating Agentic Skills list (AST) overlap on supply chain, drift and privilege. This crosswalk pairs each AST item with ASI risks, a test, and an honest tooling status.
-
Is OSV enough for agent artifacts? Measuring how many malicious MCP servers and skills appear in open malicious-package data
Of 10 documented agent-ecosystem incidents, 6 appear in the OpenSSF malicious-packages data. All 6 shipped through npm. None of the skill-store or GitHub-hosted incidents do, because OSV has no identifier for them.
-
Known bad, no known bad, unknown: a three-state policy model for agent artifacts
Most agent artifacts have never been checked by anyone. Splitting verdicts into known bad, checked with nothing found, and never checked lets policy block, log or ask a person without calling unreviewed code safe.
-
You can't govern what you can't list: an inventory of skills, MCP servers and hooks across developer laptops
Agent add-ons live in per-user JSON files and folders that MDM, EDR and SIEM do not parse. Build the inventory from those files on every laptop and every checkout. Config-path map dated 15 October 2026, plus a collection script.
-
When agent-skill scanners disagree: what conflicting verdicts on the same skill mean for your install policy
In one census, auditors gave the same skill HIGH or CRITICAL and LOW or SAFE ratings on 1,233 listings, and 87.8% of listings had no audit at all. Treat conflict and absence of audit as separate policy states, not as a pass.
-
Why agent-security statistics disagree: a source-lineage audit of the MCP and skills numbers vendors quote
We traced ten widely quoted MCP and skills statistics to their origins. Most measure different things on different populations; two have no traceable source. A register with a safe-to-cite verdict for each.
-
The 2026 agent-ecosystem incident ledger: ten malicious skills, MCP servers and lures, sourced and dated
Ten publicly documented incidents, each traced to the finder's write-up or an advisory, fall into four repeat patterns. Lookalike MCP servers lead with five. Removal time is public for only two.
