Tag
论文首次基于 GitHub 全量 SKILL.md 的 git 历史构建了 AI 代理技能的复制网络，追踪 219 万次技能采用，发现少数仓库是几乎所有复制的源头、安全修复难以传播，并提出基于复制模型的审计排序方法以识别高风险技能仓库。
AIR, an AI security startup founded by former Israeli intelligence officers, has raised $50 million to develop a platform that monitors and secures the tools, plug-ins, and add-ons used by AI agents in enterprises.
Security researcher Matt Burch disclosed nine vulnerabilities in CryptoPro Secure Disk software that could bypass encryption, revealing critical weaknesses in the software supply chain affecting ATMs and other industries.
The article covers a presentation at the FOSSY conference explaining bootstrappable builds, which enable building entire systems from minimal trusted sources to enhance software security and reproducibility.
PyPI now rejects uploads of new files to releases older than 14 days to prevent supply-chain attacks, a proactive security measure announced by Seth Larson.