A 2026 study found 26% of agent skills from public marketplaces contain vulnerabilities — and 5% show patterns of deliberate malice. NVIDIA’s SkillSpector scans skills before installation using static analysis and optional LLM review. This post covers what it catches, how to run it in CI, and the blind spots you still own. Table Of […]
Read More →You’re deep in a refactor, you hand off a task to your AI coding agent, and you walk away to get coffee. When you come back, your project directory has been restructured — but so has everything else. The agent followed a chain of reasonable-looking steps that ended somewhere you never intended. This isn’t a […]
Read More →Large language models are increasingly extensible. Whether they’re called “skills,” “plugins,” “tools,” or “MCP servers,” the core idea is the same: let an LLM invoke external code, read external data, and act on external instructions. It’s also one of the most serious attack surfaces in modern AI systems. Table Of Contents What’s the problem? Prompt […]
Read More →Forward Deployed Engineer (FDE) is the most in-demand technical role in AI right now. Not because of the title, because of the problem it solves. AI research labs are shipping capabilities faster than enterprises can absorb them. The gap between what is technically possible and what is actually running in production is enormous, and closing […]
Read More →“Most people are using MCP wrong,” said MCP’s co-creator, David Soria Parra. I agree. Because I made the same mistake. Engineers would do the obvious thing: wrap each REST endpoint as an MCP tool and shove them into a custom registry. The result? Zero value over just calling the APIs directly. Worse than zero, honestly. […]
Read More →