SetupBay

Notes

Occasional write-ups, only when we have found something worth sharing. Each one cites its sources and links to the loadouts that deal with the problem. For short dated notes on current practice, see Trends.

  1. How malicious agent skills hide their instructions

    · 5 min read

    VirusTotal found malicious agent skills hiding orders after blank lines, in HTML comments and in invisible Unicode. How to check a skill, and what our scan catches.

    Loadouts: Vet skills, plugins and MCP servers before install, Claude Code hooks guard rails, One AGENTS.md for every agent, Author plugins for Claude Code and Antigravity

Also in the Atom and RSS feeds.