Vibe CodingToxicSkills: 36% of Agent Skills Have Security FlawsSnyk Blog·high signalXBlueskyLinkedInCopy linkSnyk finds 1,467/3,984 skills have flaws, 534 critical, 76 malicious payloadsSourceSource pageSnyk Blog↳ Follow the threadStack layer / Threat patternCROSS-CATEGORY: Skills Libraries Are Becoming the Extension Point in Design and Work Tools, Replacing the Plugin MarketplaceMiniMax Design, Figma Release Notes, Asana investor release (Aug 20, Aug 13, Jun 4, 2026)Stack layer / Threat patternSkillWatermark: benign-looking skill descriptions turn agent network traffic into a covert exfiltration channelarXivStack layer / Threat patternSonarQube audit of Lovable, v0 and Replit finds vibe-coding tools have distinct, non-interchangeable quality failure modesarXivPolicy dependency / Threat patternDependency Confidence Index Scores PyPI Packages on Nine Trust Factors — and Finds Security Metrics SaturatearXiv 2608.16430Policy dependency / Threat patternKent C. Dodds ships agent-discovery endpoints in Kody: /.well-known/, markdown homepages, and RFC 8288 Link headers for unconnected agentsGitHub (kentcdodds/kody)Policy dependency / Stack layerClaude Agent SDK for Python 0.2.140 adds MCP 2.x in-process servers and a structured ResultError instead of exit code 1GitHub (anthropics/claude-agent-sdk-python)Policy dependency / Stack layerOpenAI Previews Private Safety Processing to Keep Zero Data Retention While Anthropic Now Logs 30 DaysAxiosStack layer / Threat patternA New Paper Shows Claude Sonnet 5 Changes Its Answers When It Thinks It Is Talking to an AI Safety ResearcherAI Alignment Forum (surfaced via r/ClaudeAI, 711 upvotes)