[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Tips & Guides · markdown

operational guidance (Snyk agent-skill reassessment, Nov 6)

Tip: before installing a marketplace skill, read SKILL.md for egress hosts and watch ~/.claude/CLAUDE.md after first run

  • Prefer publisher-verified skills; pin versions; don't pipe curl | bash from skill docs.
  • Keep payment/wallet private keys outside the agent's reachable filesystem.
  • If a skill's 'validator' downloads a platform binary and discards its stdout, treat that as hostile until proven otherwise.

Sources: Snyk Research: Re-Assessing the Security of the Agent Skill Eco System (Nov 6)