Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-02-26 · source-backed
Snyk scanned 3,984 agent skills from ClawHub/skills.sh: 534 (13.4%) critically vulnerable, 76 confirmed malicious. Publishing barrier: just a SKILL.md file and week-old GitHub account. Submissions jumped from 50/day to 500/day. Builder opportunity: The agent skills marketplace is the new npm -- with even weaker security. Verified skills marketplace, skill sandboxing, automated vetting services are concrete product gaps.
Each link below shares sources, entities, or timing with this story.
The agent skills supply chain is under coordinated attack. Snyk's ToxicSkills audit found 36% of ClawHub's 3,984 skills contain prompt injection payloads, 13.4% have critical malware, and submission rates exploded 10x to 500+/day. This week alone: CVE-2026-2256 (CVSS 9.1) is a...
The first real supply chain attack on the agent instruction layer landed this week, and it's worse than the early reports suggested. A campaign dubbed ClawHavoc planted 1,184 malicious skills in ClawHub — OpenClaw's official skill marketplace — by embedding adversarial instruc...
A GitHub repo cataloging Claude Code tips doesn't normally warrant a top story. But shanraisshan/claude-code-best-practice at 53.4K stars isn't a tips list anymore. It's the de facto reference for how an entire generation of developers is learning to work with AI coding agents...
Anthropic invented a file convention. It's now shipping GA inside a competitor's product. Nobody wrote a spec, nobody held a standards meeting, it just happened. On July 29, GitHub made agent skills and MCP server support generally available in Copilot code review for all Pro,...
Anthropic's "The Briefing" enterprise event today unveiled Agent Skills as an open standard for pluggable agent capabilities, with launch partners including Microsoft, OpenAI, GitHub, Atlassian, Figma, Canva, Stripe, Notion, and Zapier. OpenAI was discovered to have quietly ad...
Y Combinator CEO Garry Tan open-sourced GStack and the repo hit 10,000 GitHub stars in 48 hours. That makes it one of the fastest-growing dev tools of 2026. GStack is a 23-tool MIT-licensed toolkit that turns Claude Code into role-based agents: CEO, Designer, QA, Release Manag...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.