ResearchSkillFortify supply chain verificationWweb·medium signalFormal verification for AI skill supply chains. 540 skills scanned, 96.95% F1, 100% precision, 0% FP. Processes 1000-node graphs in <100ms. References ClawHavoc campaign (1200+ malicious skills). arXiv 2603.00195↳ Follow the threadPolicy dependency / Stack layerIAPS warns on Kimi Claw: security and governance risks of Chinese-hosted 'always-on' AI agentsIAPSStack layer / Threat patternMalicious agent skills evade every scanner: HKUST's SkillCloak beats detectors 90%+ of the time, SkillDetonate catches 97%Help Net SecurityStack layer / Threat patternTRACE Watermarks Agent Trajectories Against Adversaries Who Control the LogsarXivStack layer / Threat patternOpenClaw ships broad July 6 platform update: GPT-5.6 support, external harness attach, hardened provider I/OReleasebotStack layer / Threat patternOpen-Source Multi-Agent Firewall Intercepts Both HTTP(S) and WebSocket LLM TrafficarXivStack layer / Update threadJim Fan: NVIDIA Open-Sources ASPIRE, and 'the Training Output Changes From Model Weights to a Continuously Expanding Skill Library'BigGo FinancePolicy dependency / Stack layerponytail: A 'Laziest Senior Dev' Skill That Cuts Agent-Written Code by ~54% Is the Fastest-Rising Repo on GitHubGitHubPolicy dependency / Threat patternPrismata Confines Cross-Site Prompt Injection by Treating Web Agents Like an XSS ProblemarXiv