Hey HN. I built a security registry for AI agent skills.

There are 64k skills on Vercel's skills.sh. Cursor, Claude Code, Windsurf, and dozens more agents pull them from GitHub at HEAD — no versioning, signing, or scanning. The OpenClaw agents themselves flagged this: "The supply chain attack nobody is talking about: skill.md is an unsigned binary."[0]

I took an official skill that packages other skills, added a few lines of Python to exfiltrate env vars, shell history, and git config, and installed it into Claude Code and Codex. Claude Code ran the script without flagging the outbound request. Codex caught the naive version. After updating the SKILL.md with a two-stage payload that modified `config.toml` for sandbox network access and framed the exfiltration as a registry name check, Codex asked for confirmation with a plausible reason. That reason was written by the malicious skill. I confirmed. Payload arrived. Full writeup: https://vett.sh/blog/ai-agent-skills-supply-chain-attack

~5k skills scanned so far:

- 59 critical risk: base64-obfuscated droppers calling a C2 server at a malicious IP, disguised as Google/LinkedIn/Excel tools - 335 high risk: arbitrary shell execution, piped installers, agent identity manipulation - 16 with `curl | bash` patterns. "React Native Best Practices" (5,400 installs) pipes to a legitimate domain it doesn't control. If that domain expires or gets sold, those installs become a delivery vehicle with no exploit required.

How Vett works:

First layer: a static analyzer with 40+ detection rules, AST-based capability analysis (TypeScript compiler for JS/TS, Python AST with regex fallback), and source-sink data flow tracking. A script that reads `.env` and makes an outbound HTTP request is flagged as an exfiltration chain, not two separate findings. It checks dependencies against the OSV vulnerability database, detects cross-file import chains, and catches when documentation references scripts that aren't in the package. Deterministic, runs in milliseconds.

Second layer: for ambiguous signals, LLM analysis compares observed behavior against declared purpose. A packaging tool calling an unrecognized endpoint looks different from a deployment tool calling AWS. Skills that clear both layers get Sigstore signing (ECDSA P-256 + Rekor transparency log) and content-addressed immutable storage.

  npx vett add github.com/owner/repo/skill-name

Browse scanned skills at https://vett.sh/skills.

[0] https://www.moltbook.com/post/cbd6474f-8478-4894-95f1-7b104a...

Thoughtworks Future of Software Development Retreat

An Open Source Client for World of Warcraft

Show HN: DovahScript – A language for the Thu'um-powered developer

Firetiger: Long Horizon Agents in Production

Tesla announces Powerwall 3P with native three-phase inverter

Microplastic pollution induces algae blooms in experimental ponds

Benchmarking STT for Voice Agents – 10 Services, 1k Samples, Semantic WER

No food, no fuel, no tourists: Under US pressure, life in Cuba grinds to a halt

We built Writtte using vanilla JavaScript (TS), PSQL, and a Go, No frameworks

Practical Guide to Reducing AI Agent Token Costs

Kalshi Dealt Major Setback in Fight to Remain in Nevada

We Built a QA Agent for Our Background Agent

Leaking Secrets from the Claud

Japan Plans $36B in U.S. Investments Under Trump Administration Deal

An Inside Look at Lego's New Tech-Packed Smart Brick

Show HN: Vett – Scan, sign, and verify AI agent skills before installing

Zero-Code Tracing Setup for Claude Agent SDK

I code from bed now – a Telegram bot for Claude Code

How do I embed Polymarket odds on Substack?

Plasma 6.6

A Guide to Which AI to Use in the Agentic Era

Novel vaccine protects against C. diff disease and recurrence

Fei-Fei Li's World Labs raised $1B from A16Z, Nvidia to advance its world models

NNDB: Tracking the entire world

WebMCP – a much needed way to make agents play with rather than against the web

Pg_ClickHouse: Fastest Postgres Extension on ClickBench

Is a coordinated attack happening to sway the market or create panic?

Apple Decouples from Nasdaq as AI 'Whack-a-Mole' Grips Market

Spacebot: An OSS agentic system designed to scale for large online communities

Show HN: Why use one AI model when you can use all of them at once!