A 2026 study found 26% of agent skills from public marketplaces contain vulnerabilities — and 5% show patterns of deliberate malice. NVIDIA’s SkillSpector scans skills before installation using static analysis and optional LLM review. This post covers what it catches, how to run it in CI, and the blind spots you still own. Table Of […]
Read More →AI coding agents are fast, but they cut corners. Agent Skills is an open-source project by Addy Osmani that gives agents the same structured workflows senior engineers follow, from spec to ship. This post breaks down how it works, explains the Google engineering principles it builds on (Hyrum’s Law, Chesterton’s Fence, the Beyonce Rule, Shift […]
Read More →OWASP Snakes and Ladders is an educational project. It uses gamification to promote awareness of application security controls and risks, and in particular knowledge of other OWASP documents and tools. In the board game for web applications (Print-ready PDFs), the virtuous behaviors (ladders) are secure coding practices (from OWASP Proactive Controls project 2014-2016) and the […]
Read More →The OWASP Mobile Security Testing Guide (MSTG) is the ultimate guide for mobile app security testing and reverse engineering. The MSTG is a comprehensive manual for testing the security of mobile apps. It describes technical processes for verifying the controls listed in the OWASP Mobile Application Verification Standard (MASVS). The MSTG provides a baseline set […]
Read More →OWASP Juice Shop is an intentionally insecure webapp for security trainings written entirely in Javascript which encompasses the entire OWASP Top Ten and other severe security flaws. Juice Shop is written in Node.js, Express and AngularJS. The application contains more than 30 challenges of varying difficulty where the user is supposed to exploit the underlying […]
Read More →