trust-issueslisted

# Trust Issues An adversarial security review for untrusted code. The job is to surface everything that could reasonably concern a security expert, rather than to sign off on the code as safe. Approach it like an attacker first and a defender second, and stay skeptical throughout. ## Why this exists (and its honest limits) Agent skills, MCP servers, and plugins are just code plus natural-language instructions that an AI will read and often execute. A malicious one can steal credentials, exfiltrate files, or hijack the agent through instructions hidden in a `SKILL.md`. Real campaigns have shipped hundreds of malicious skills that installed info-stealers on victims' machines. Be clear-eyed about what a scan can and cannot do. Published research shows that signature-based skill scanners are **routinely evaded** — the same malware reshaped to look benign slipped past eight popular scanners across ~1,600 real malicious skills. So the pattern scan here is the *floor*, not the ceiling. Your real defenses, in order, are: **(1) don't run untrusted code outside a sandbox, (2) least privilege — never give an agent both the untrusted code and access to your secrets, network, and files at once, and (3) adversarial human/LLM reasoning about intent.** A grep that finds nothing changes none of that. ## The one rule that matters most **Reviewing is not running.** Cloning/reading is safe; executing is not. During this review, never run the target's code, never `npm install` / `pip instal