When Package Managers Can't Help: Defending AI Agent Skills Against Supply Chain Attacks

A real-world implementation of static + LLM-based scanning for Claude Code / Cursor skill layers npm's supply chain defenses have matured fast. By 2026, pnpm ships with automatic 1-day release age cooldown (default ON), and npm v12 will block install scripts by default. The battle for package-layer security is being won. But the attack surface moved. And the new frontier is invisible to traditional security. When you run npx some-skills add frontend-design, you're importing a skill — a SKILL.m...