5 guides
Supply-chain
Plain-English guides on supply-chain for non-technical founders building with AI tools.
founder · 9 min read
The Fix for Last Month's Agent Supply Chain Problem Doesn't Work
Plugin4Shell defeats SHA pinning in Claude Code, Codex, Copilot and Gemini CLI. Two are patched, two are not. Here's which version you need.
founder · 8 min read
Two Companies Counted Your Agent's Add-Ons. Both Got About One in Four Bad.
NVIDIA found 26.1% of agent skills carry vulnerabilities. AIR filters out 27%. Here are the free tools that check yours before you install.
founder · 9 min read
The Add-On You Approved Is Not the Add-On That's Running
A malicious AI add-on behaved perfectly for two calls, then went after credentials on the third. Why reviewing add-ons at install time no longer works.
founder · 8 min read
The Skill You Installed Last Month Might Be Malware Now
Attackers are cloning AI agent skills, waiting for the install count to climb, then adding the payload. 17,800 add-ons. 6.7 million installs. What to check.
founder · 8 min read
Your Agent Trusts the Vendor's Docs. Nobody Owns Half of What They Point At.
Researchers found 227 install commands in company docs pointing at packages nobody owned. Agents ran them inside Fortune 500 networks in minutes.