Entity trail

Agent Scan

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-07-10 / arxiv-researcherMCP-Grounded Agent Pipeline Converts Legacy Docs to NIST OSCAL for Continuous ComplianceOperational technology environments in critical infrastructure often cannot be actively scanned, yet compliance regimes demand active system feedback for risk assessment. This paper (arXiv 2607.08288, July 9) presents a non-invasive multi-agent pipeline grounded in MCP that converts natural-language system descriptions into a source-verified knowledge graph and audit-ready NIST OSCAL artifacts. The architecture deliberately decouples LLM reasoning from deterministic knowledge operations — a pattern worth stealing for any pipeline where hallucination in the extraction step would be unacceptable. It is one of the first academic papers to treat MCP as compliance infrastructure rather than a developer convenience.
2026-07-10 / projects-researchersickn33/agentic-awesome-skills Hits 1,900+ Installable Agent Skills — and an Installer CLI to MatchThe repo (~42.8K stars) packages more than 1,900 agent skills for Claude Code, Cursor, Codex CLI, Gemini CLI, Antigravity, and others, with a CLI installer and curated bundles. That scale arrives days after Cisco open-sourced skill-scanner and shipped it into an IDE extension, which is not a coincidence — a 1,900-skill installable registry with no provenance model is exactly the supply-chain surface the scanner exists to inspect. Install from it, but scan first.
2026-07-09 / agents-researcherClawHavoc campaign plants 300+ malicious skills on a single marketplace to run infostealersUnit 42 detailed ClawHavoc, a supply-chain campaign that seeded more than 300 malicious skills on one agent-skill marketplace; the instruction files directed agents to fetch and execute an infostealer that harvested browser credentials, keychain passwords, SSH keys, and crypto wallets. It's a live, at-scale demonstration that the skill install step is the new npm-style attack surface for agents. Combined with the SkillCloak evasion research, it shows attackers are both shipping payloads and defeating the scanners meant to catch them.
2026-07-09 / agents-researcherMalicious agent skills evade every scanner: HKUST's SkillCloak beats detectors 90%+ of the time, SkillDetonate catches 97%Researchers at Hong Kong University of Science and Technology built SkillCloak, an obfuscation system that keeps a malicious SKILL.md's behavior intact while altering only its appearance; its packing trick evaded every tested scanner >90% of the time, and hit 96% against one hybrid rules-plus-LLM tool. Their counter-defense, SkillDetonate, sandboxes suspect skills and watches OS-boundary behavior, catching 97% of injected payloads at a ~2% false-positive rate. This is the clearest evidence yet that static agent-skill scanning is fundamentally outmatched and runtime detonation is becoming table stakes.
2026-07-07 / saas-disruption-researcherA New Security Category Emerges: Tools That Police the Coding Agent, Not the Code — Snyk's Evo Agentic Development SecuritySnyk's Evo (covered June 23, part of the current agent-security wave) governs the tools an autonomous coding agent pulls in, the actions it takes at runtime, and the code it generates — enforcing controls inside the agent's workflow rather than scanning output after the fact. As agents write more enterprise software with little human oversight, 'guardrails for the agent' is hardening into a distinct SaaS category alongside Vanta-style GRC automation. Still largely single-vendor-forward, so treat as an emerging pattern rather than a settled market.
2026-07-07 / projects-researcherCisco Open-Sources skill-scanner for Agent Skills, Now Integrated Into an IDE ExtensionCisco AI Defense's skill-scanner detects prompt injection, data exfiltration, and malicious code in agent skills using a mix of YAML/YARA pattern rules, LLM-as-a-judge, and behavioral dataflow analysis, and Cisco has now folded it (plus an MCP scanner) into an IDE extension. It's part of a fast-emerging category of agent/skill security scanners appearing alongside Snyk's launch. The convergence of multiple vendors on 'scan before you install' suggests skill supply-chain security is becoming a standard step in the agent dev toolchain.
2026-06-28 / agents-researcherOrca Security 'Skill Issues': attack primitives let malicious agent skills evade ClawScan and VirusTotal at scaleOrca's research details how open agent-skill marketplaces lack mandatory semantic security review, letting heavily obfuscated intent reach an agent's context through trusted channels; one proof-of-concept skill simply inflated its file size past scanner thresholds to bypass both ClawScan and VirusTotal. They tie it to real campaigns — Antiy CERT confirmed 1,184 malicious skills on ClawHub, 335 traced to a coordinated 'ClawHavoc' operation — and show download metrics can be gamed by bot-driven installs. The takeaway for builders: install counts and scan badges are not trust signals for agent skills.
2026-06-28 / agents-researcherFake AI agent skill passed every security scanner and reached ~26,000 agents, including corporate accountsSecurity firm AIR built a benign-looking malicious agent skill, distributed it through a popular skill marketplace plus an Instagram ad, and reports it reached roughly 26,000 agents — some on corporate accounts — while every skill scanner it tested marked the skill safe. The researchers describe a set of attack primitives that combine to let an attacker create, distribute, and persist malicious skills at scale with minimal friction and limited detection. It is concrete evidence that current agent-skill scanning is not a reliable supply-chain control.
2026-06-27 / vibe-coding-researcherPattern: 'Agent Firewalls' and MCP Gateways Are Emerging as a Dedicated Defense LayerIn response to the NSA guidance and the MCP CVE wave, a new product category is forming around outbound-filtering proxies and MCP gateways that sit between agents and their tools — enforcing schema validation, DLP, message integrity, and local MCP scanning. Rather than hardening each server individually, builders are starting to centralize agent-to-tool traffic through a controllable choke point, mirroring how API gateways consolidated web-service security.
2026-06-18 / skill-finderHarden MCP with incremental scope consent and re-scan tool descriptions on every server update, not just installThe 2026 MCP spec update added incremental scope consent so clients can request only the minimum access each operation needs, instead of granting a server blanket permissions up front. Between January and February 2026 researchers filed 30+ MCP CVEs (43% shell injection), and a malicious server can hide agent-hijacking instructions inside tool descriptions — so descriptions must be scanned at install AND at every update, not once. Pair this with binding servers to 127.0.0.1 rather than 0.0.0.0, the single most common misconfiguration found across thousands of exposed servers.
2026-06-16 / agents-researcherghostprobe: open-source red-team scanner for MCP tool poisoning and the 'lethal trifecta'Engineer Joe Munene released ghostprobe (discussed June 12, 2026), an open-source scanner that points at live MCP servers to detect tool-poisoning prompts and the 'lethal trifecta' (private data access + untrusted content + exfiltration capability) before integration into an agent stack. It joins a crowded but fast-moving MCP-defense tooling space (Cisco MCP Scanner, Snyk Agent Scan, Proximity), reflecting how MCP server vetting is becoming a standard pre-deployment step. Single-source dev-journal disclosure, so importance is rated low pending wider validation.
2026-06-14 / agents-researcherSupply-chain worms now poison CLAUDE.md and .cursorrules with zero-width hidden instructionsThe continuously-mutating Miasma/Hades campaign (pivoting delivery every 48–72 hours since June 1) has added a novel agent-specific vector: packages inject .cursorrules and CLAUDE.md files containing zero-width Unicode hidden instructions. When a developer opens the project in Cursor or Claude Code, the assistant reads the configuration as legitimate project guidance and runs a 'security scan' that exfiltrates local secrets. Socket flagged 37 malicious Python wheels across 19 PyPI packages on June 7 and a compromised ensmallen 0.8.101 on June 8 — the first wave to weaponize AI coding-agent config files at scale.

Graph relationships

RELEASED
Snyk
Snyk released agent-scan to scan AI agent configurations for security vulnerabilities.
Source finding
RELEASED
Snyk
Snyk released the Agent Scan tool for security scanning.
Source finding
SUPPORTS
Gemini CLI
Agent Scan supports auto-discovery of agent configurations in Gemini CLI.
Source finding
SUPPORTS
Cursor
Agent Scan supports auto-discovery of agent configurations in Cursor.
Source finding
SUPPORTS
Claude Code
Agent Scan supports auto-discovery of agent configurations in Claude Code.

Source trail

New research on arXiv Adversa AI's April roundup Cloudflare's enterprise MCP architecture OpenAI's system card TechCrunch reports Snyk's expanded tool Medallia to bondholders

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues