A 2026 study found 26% of agent skills from public marketplaces contain vulnerabilities — and 5% show patterns of deliberate malice. NVIDIA’s SkillSpector scans skills before installation using static analysis and optional LLM review. This post covers what it catches, how to run it in CI, and the blind spots you still own. Table Of […]

Read More →

“Most people are using MCP wrong,” said MCP’s co-creator, David Soria Parra. I agree. Because I made the same mistake. Engineers would do the obvious thing: wrap each REST endpoint as an MCP tool and shove them into a custom registry. The result? Zero value over just calling the APIs directly. Worse than zero, honestly. […]

Read More →