MindPattern
← The Wire

Public story · 2026-02-23 · source-backed

Agent Skills Supply Chain Gets Triple-Layer Security

Confidence
source-backed
Sources
2
Redaction
passed

Story

Vercel's skills.sh marketplace (69,000+ skills across 15+ platforms including Claude Code, Cursor, Copilot, Codex, Windsurf) now has three independent security layers:

  1. Snyk — Scans at install-time, catching prompt injection in 36% of skills and 1,467 malicious payloads
  2. Gen (Norton) Agent Trust Hub — Independent safety verification with four risk tiers (Safe / Low Risk / High Risk / Critical Risk)
  3. Socket — npm-style supply chain scanning with 94.5% precision

Builder action: Publish skills on skills.sh to benefit from scanning. Install via npx skills which routes through these checks. This is the first agent ecosystem with npm-grade supply chain security.

Source: Snyk Blog | Gen/Vercel PR

Related stories

Each link below shares sources, entities, or timing with this story.

  1. Shared entities / Shared topic / What happened next

    A 54k-star skill that makes Claude talk like a caveman, and the math that deflates it

    Both cover Claude Code, Codex, Copilot, Cursor; overlapping topics (agent, claude, code); picks up the Claude Code thread on 2026-06-12.

  2. lean-ctx Ships "Context OS" for AI Development. 60-99% Token Reduction via MCP Server.

    Both cover Claude Code, Codex, Copilot, Cursor; overlapping topics (claude, code, codex); picks up the Claude Code thread on 2026-05-10.

  3. Shared entities / Shared topic / What happened next / Tension

    SANDWORM_MODE: MCP Config Poisoning as Attack Vector

    Both cover Builder, Claude Code, Cursor, Windsurf; overlapping topics (builder, chain, claude, code); picks up the Builder thread on 2026-02-26.

  4. Shared entities / Shared topic / What happened next

    Anthropic Engineers Say Stop Building Agents, Build Skills Instead

    Both cover Claude Code, Codex, Cursor, Windsurf; overlapping topics (agent, claude, code, codex, skill); picks up the Claude Code thread on 2026-04-21.

  5. RTK Hit 48K Stars by Doing One Thing: Cutting Your AI Coding Bill 60-90%

    Both cover Claude Code, Codex, Cursor, Install; overlapping topics (claude, code); picks up the Claude Code thread on 2026-05-15.

  6. Understand-Anything turns any codebase into an interactive knowledge graph.

    Both cover Claude Code, Codex, Copilot, Cursor; overlapping topics (agent, claude, code, codex); picks up the Claude Code thread on 2026-06-27.

  7. Vibe Kanban goes fully community-maintained as Bloop winds down hosted services.

    Both cover Claude Code, Codex, Copilot, Cursor; overlapping topics (agent, claude, code, codex); picks up the Claude Code thread on 2026-06-10.

  8. GitHub Ships Cross-Model Code Review, and the Pattern Is Bigger Than It Looks

    Both cover Claude Code, Copilot, Cursor, Windsurf; overlapping topics (action, agent, claude, code); picks up the Claude Code thread on 2026-05-11.

Source trail

Snyk BlogGen/Vercel PR

Entities

Agent Trust HubBuilderClaude CodeCodexCopilotCritical RiskCursorHigh RiskIndependentInstallLayer Security VercelLow RiskNortonPublishSafeScans

Provenance

Canonical issue
Ramsay Research Agent — 2026-02-23
AI generated
no
Story unit
2026-02-23-agent-skills-supply-chain-gets-triple-layer-security
Labels
source-backed, canonical briefing excerpt
Agent Skills Supply Chain Gets Triple-Layer Security | MindPattern