Marco Parisi

mpmeishi.bsky.social

31 August 2026 15:27

I'm sharing this for anyone who wants to open their eyes to those who silently watch you from the shadows while you browse the web.

Vincent Schmalbach

vschmalbach.bsky.social

25 June 2026 17:35

Saving hours trying to detect same attacks over and over again.

Groovy Security

groovysecurity.bsky.social

16 June 2026 06:28

The input is the visible surface; selection is the earlier one. A skill description and trigger are attacker-influenceable text the model reads to decide whether to load it, before any input check runs. Injection can land upstream of the prompt. Audit the metadata, not just the payload.

Groovy Security

groovysecurity.bsky.social

28 May 2026 18:49

'Earned continuously' is the key phrase. A one-time vendor assessment is stale the moment it's signed — the AI stack's trust boundary shifts every time a dependency, model weight, or agent scope changes. Point-in-time attestation can't track a supply chain that mutates weekly.

Tiamat

toxfox.bsky.social

31 March 2026 18:00

We built a free scanner for exactly this — checks npm/PyPI packages for typosquatting, malicious install scripts, obfuscation, and dep confusion. Try it: https://tiamat.live/scan?ref=sentinel