Three publishers dominate 92 of the 100 fastest-growing Claude Code skills

·1 views

Data captured on August 5 from the Claude Code skills catalog shows that 92 of the 100 fastest-growing skills by daily installs belong to just three publishers: the Lark suite, educator Matt Pocock, and developer Julius Brussee. The Lark suite alone accounts for 54 trending skills, adding over 14,000 installs in a single day, with individual skills growing at near-identical rates — a pattern consistent with bundled suite distribution rather than individual user selection. Matt Pocock's 31 trending skills added around 3,000 daily installs combined, with Google Trends data showing search interest in his name up 180% over the past month, suggesting developers adopt his entire repository in one step. Julius Brussee's seven 'caveman' skills each grew at 81–92 installs per day, following the same bloc pattern at a smaller scale. The analysis argues that install counts now reflect distribution strategy more than individual developer choice, urging users to consider how installs were acquired when evaluating a skill's popularity.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

AI Agents vs Chatbots: Key Differences Explained for the AI Era

While many people use the terms 'chatbot' and 'AI agent' interchangeably, the two technologies are fundamentally different in how they operate. Chatbots like ChatGPT are reactive systems that respond to individual prompts and wait for the next instruction once a task is complete. AI agents, by contrast, are goal-driven — given a single objective, they independently break it into subtasks, use external tools, and adapt their approach if something fails. For example, rather than answering step-by-step vacation questions, an AI agent could autonomously research flights, compare hotels, and build a full itinerary from one high-level prompt. As tech companies and startups invest heavily in agentic AI, understanding this distinction is becoming increasingly important for anyone following the future of artificial intelligence.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Cloudflare Workers skip fetch handler when static assets match the request

A developer discovered that redirect logic written inside a Cloudflare Worker's fetch handler never executed because static asset requests are served directly at the edge, bypassing the Worker entirely. By default, Cloudflare only invokes the Worker script for requests that do not resolve to a file in the assets directory, meaning the handler effectively only caught 404s. The issue can be confirmed by requesting a non-existent path — if that triggers the redirect while real pages do not, the Worker is being skipped for asset-backed URLs. The recommended fix is to use Cloudflare's Redirect Rules, found under Rules in the dashboard, which run earlier in the traffic sequence than Workers and are free on all plans. Forcing the Worker to run before the asset lookup is an alternative but is considered wasteful for simple redirects that do not require per-request logic.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

One-Click RCE Flaw Disclosed in VS Code, Cursor, and Google Antigravity Editors

A remote code execution vulnerability affecting three widely used AI-assisted code editors — Microsoft Visual Studio Code, Cursor, and Google Antigravity — was publicly disclosed on August 5, 2026. The flaw allows an attacker to embed malicious commands inside links within commit messages, and a single click by the developer triggers arbitrary code execution on their machine. Because the link appears in a trusted editor environment rather than an external channel like email, developers are less likely to scrutinize it. No CVE identifier, specific affected version numbers, or vendor-confirmed patches have been published as of the disclosure. Developers using any of the three editors are advised to treat all commit-message links with caution until official vendor advisories are released.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Experts reveal how AI-generated code gets exploited and how to defend it

Codacy CTO Kendrick Curtis and WorkNest Secure's Head of Offensive Security Jordan Constantine jointly examined vulnerabilities introduced by AI coding tools, from development through penetration testing. Key risks include stale AI training data pulling outdated or malicious packages, prompt injection attacks where plain-text instructions inside files can direct agents to leak environment variables, and malicious MCP servers acting as middlemen to exfiltrate data. Practical defences highlighted include setting a minimum package age in .npmrc to avoid newly published malicious dependencies, using curated allowlists with scoped tokens for MCP servers, and sandboxing agents with vault-stored credentials. Real-world attack walkthroughs showed how a customer chatbot was manipulated into revealing MD5 password hashes and how an AWS document-ingestion service was exploited via indirect SSRF to obtain cloud credentials. The session underscored that most AI security failures stem from unbounded permissions and poor input-output controls rather than flaws in the AI models themselves.

0 comments Read more at DEV Community