Following the agent’s trust.

Agent skills introduce instructions and executable resources into an assistant’s workflow. In our co-authored technical report, we examined 3,984 skills and documented security issues in this emerging ecosystem, including malicious content and risks to credentials.

The work applies software supply-chain thinking to the resources an agent discovers and trusts. The report is available as an arXiv preprint, with its full author list on the papers page.

My credited disclosures include command injection in MCP tools, path traversal, information exposure, and authorization failures. These findings examine what happens when model-driven requests reach shells, filesystems, or databases.

Examples include adb-mcp command injection (CVE-2025-59834) and a read-only-mode bypass in Apache Doris MCP Server (CVE-2025-58337). Each entry links to the public advisory so readers can inspect the affected versions, credits, and remediation details.

In Snyk VulnBench JS 1.0, we studied whether repeated LLM reviews of the same JavaScript code produce consistent vulnerability findings. The benchmark focuses on repeatability, an important dimension of whether a security workflow can be relied on.

VulnBump examines a complementary question: can an agent upgrade vulnerable dependencies while preserving a working project? Its tasks verify dependency resolution, vulnerability fixes, builds, and tests together. Both studies are co-authored preprints.