Agent skills, plugins and MCP servers extend coding and productivity agents with instructions and scripts. Installing one gives its author influence over what your agent reads, writes and runs. The risks we found reviewing community skills, a review checklist, and the sandboxing and policy controls we use.
The contrib distribution of the OpenTelemetry Collector ships hundreds of components we never use. We built our own distribution with the OpenTelemetry Collector Builder: a manifest with only our receivers, processors and exporters, a reproducible image, a smaller attack surface and faster upgrades. The full workflow.
Attackers copy popular repositories, add malware and promote the copies with similar names and fake stars. A practical guide for maintainers and users: how fake clones and repojacking work, how to make the real project verifiable with signed releases and provenance, and what to check before installing.
We rotated the cosign key used to sign container images, and within minutes Kyverno rejected every new pod in production: no matching signatures. The policy trusted only the old public key, and images signed before the rotation needed it too. How we recovered and the staged rotation we use now.
A pull request added a dependency that an AI assistant had suggested. The package name did not exist when the code was written, and a few weeks later someone else published it. We caught it in review by luck, then added registry checks so we do not rely on luck.
An internal audit found a workflow that used pull_request_target to post preview links and also checked out the pull request's code and ran npm install. Any fork PR could have run code with our deploy token. We split it into an unprivileged build and a privileged comment step.
In March 2025 the popular tj-actions/changed-files action was compromised and its version tags were repointed to code that printed CI secrets into workflow logs. Three of our repositories used it by tag. This is how we checked exposure, rotated secrets and moved to SHA pinning.