Vercel's Skills API Turns Agent Skills Into Infrastructure
Vercel's skills.sh API exposes 600,000+ agent skills to any tool holding an OIDC token. Pin the content hash, not the name, before you let an agent install one.
#scanning
4 articles with this tag.
VIPER-MCP Shows Agent Tools Need Taint Scanning
VIPER-MCP scanned 39,884 MCP server repos and confirmed 106 zero-days, 67 with CVE IDs. Agent tools need code-level taint analysis, not trust prompts.
Why Scanning Architecture Matters: Comparing Skill Registry Security
Three registry security models - reactive moderation, install-time scanning, and dual-side verification with a tree hash - and the attack each one misses.
How Dual-Side Verification Protects Against Supply Chain Attacks
Dual-side verification scans a shared AI skill twice, once by the publisher and once by you, then compares both reports and a SHA-256 tree hash before install.