skillvet tool scans AI agent skills for supply-chain threats in seconds

·1 views

A new open-source command-line tool called skillvet lets developers scan AI agent skill folders and MCP servers for potential security risks before running them. The tool checks for undeclared network calls, secret file access, suspicious install hooks, obfuscated code, and unauthorized binaries, returning a RED, YELLOW, or GREEN verdict in roughly five seconds. It reads the file tree without executing any code and requires no installation beyond a single npx command on Node 20 or later. The tool's release follows a reported surge of around 7,600 malicious GitHub repositories in August 2026, over 800 of which were disguised as AI skills or MCP servers. Developers can whitelist legitimate domains inside a skill's manifest so declared hosts are not flagged as suspicious outbound connections.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Tokyo Startup's Product Hunt Launch Nets 2 Upvotes and Zero Signups

A small Tokyo-based software company launched its outbound sales tool LeadAce on Product Hunt on August 19, receiving only 2 upvotes, 1 comment, and zero signups within 24 hours. The founder attributed the failure not to product quality but to a lack of established account history on key platforms like Hacker News and Reddit, which gate participation by karma and account age. Attempts to post on several subreddits were blocked or removed due to low karma scores and account newness rules. Despite the poor Product Hunt result, posts on r/SaaS and r/SideProject generated genuine user engagement, including questions that directly influenced the product roadmap. The founder documented every metric publicly while the results were still uncomfortable, noting that community presence must be built months before a launch, not during it.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

SPX Options Book Turns Over Fast: 44% of 0DTE Positions Are New Each Day

A data analysis covering 1,081 trading sessions from April 2022 to August 2026 examined how much of the SPX and SPXW options open interest is created versus carried over each day. Researchers used open interest and volume figures across 8.6 million contract-days to measure how quickly positions are built or unwound. On the median session, net change in open interest equals about 40% of daily volume, meaning the book is consistently growing faster than it is being closed out. For contracts expiring the next day, roughly 44% of the opening 0DTE book did not exist the prior morning, a share that has risen to around 52% in 2026. By 2026, 0DTE contracts were trading nearly eight times their opening open interest on a typical session, meaning OI-based dealer-gamma models capture only a fraction of actual intraday activity.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How running chess engines in the browser eliminates the one-game-a-day analysis limit

Most chess platforms cap free game analysis at one game per day, a limit driven by real server costs rather than pure monetisation strategy. Analysing a single 40-move game requires evaluating roughly 80 positions, consuming nearly three minutes of CPU time per user, which adds up to around 50 CPU hours daily at just 1,000 users. Because each game is unique, none of this computation can be cached, making the free tier genuinely expensive to operate at scale. A technical alternative exists: Stockfish, the open-source chess engine, can be compiled to WebAssembly and run directly inside the user's browser via a Web Worker, shifting all processing costs to the visitor's own device. This approach means the server only needs to deliver static files, eliminating per-user compute costs entirely and removing any practical reason to impose a daily analysis cap.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Multi-Agent AI System Cuts Test Automation Effort by 78%, from 45 to 9.5 Hours

Engineering teams have developed an AI Test Automation Factory that replaces traditional manual test scripting with a pipeline of specialized AI agents, each handling a distinct phase of the automation workflow. The system routes requirement documents through five sequential agents — covering context generation, test case design, feature file creation, page object modeling, and step definitions. Total effort per scenario dropped from 45 hours to 9.5 hours, while test coverage improved from 65% to 90% and defect leakage fell from 12% to 5%. The framework includes a governance layer with token usage tracking, cost monitoring, and real-time Power BI dashboards for executive oversight. Future development aims to incorporate the Model Context Protocol (MCP) to enable fully autonomous, self-healing test execution without human intervention.

0 comments Read more at DEV Community