Report Date: 2026-09-28 | Language: English | Generated At: 2026-09-28T16:30:45.000Z
# Today's Best Build: SkillLock
**Report Date**: 2026-09-28
**Coverage**: 2026-09-28T00:00:00+08:00 – 2026-09-28T23:59:59+08:00 (UTC)
**Status**: ok
## Today's Best Build: SkillLock
**One-liner**: A local lockfile verifier that proves the plugin and skill code your coding agent loads actually matches the commit SHA you approved — before it runs, across Claude Code, Codex, Copilot and Gemini CLI.
**Why Now**: Plugin4Shell made the gap explicit: every major agent marketplace checks out a SHA-pinned commit but never verifies that the checked-out tree matches that SHA. A single proof-of-concept plugin reached 26,000 agents before takedown, and the parallel SkillJacking campaign hijacked 925 already-installed skills affecting 134,000 agents. The vendor fix path is broken — Google deprecated Gemini CLI rather than patching it, and GitHub Copilot shipped no fix at disclosure. That leaves an entire class of
**Evidence**:
- Plugin4Shell is a zero-click RCE rooted in a verification gap, not a detection gap: marketplaces pin plugins to a commit SHA but never confirm the checked-out code matches it. One PoC plugin spread to more than 26,000 agents, and SkillJacking hijacked 925 in-use skills affecting 134,000 agents. _(signal #77889)_
- The same architectural pattern shows up in enterprise agents: SalesBleed chained three zero-click flaws in Salesforce Agentforce, where data a human never reviewed (a web-form lead) was read by an agent holding full CRM access and exfiltrated via DNS. _(signal #77890)_
- The tooling rush has already started but points at runtime, not install time: VibeDefend launched as 'the one command line to secure your Cursor and Claude Code', and vantage.ai sells 'see and control what your coding agent does' — both observe agent activity after code is already executing. _(signal #78080)_
- Agent-native offensive tooling is trending fast (Seep Reverse Lab: 475 stars, 23 integrated MCP tools, 289 knowledge-base journals), which means the attacker-side automation for finding these marketplace gaps is being built faster than the defender-side verification. _(signal #77869)_
- Even when a guardrail exists, models treat untrusted tool output as fact: in the ToolTrap benchmark, GPT-5.4 nano presented a planted callback number from imported notes as 'verified support information' despite an explicit system-prompt rule that tool results are data, not instructions. _(signal #78205)_
**Fastest Validation**: Run the scanner against the 100 most-installed public skills in one agent marketplace and publish the raw numbers: how many pin a SHA, how many have a working tree that no longer matches that SHA, and how many have no verifiable pin at all. Post the report into the Plugin4Shell discussion thread and r/SideProject with the JSON output attached. If fewer than 5 of 100 are mismatched, the lockfile thesis is too late or too weak; if 20+ are, you have a landing page in a day.
**Counter-view**: VibeDefend (on Product Hunt today) already sells 'the one command line to secure your Cursor and Claude Code', and vantage.ai sells runtime control over what a coding agent does — both assume the damage happens at tool-call time. Plugin4Shell's 26,000-agent PoC executed at plugin load and update, before any runtime monitor sees a tool call, so a runtime guard is structurally blind to it. And the vendor path is not a fallback: Google deprecated Gemini CLI rather than patch it and GitHub Copilot s
## Top Signals
### Plugin4Shell Hit 26,000 Agents Before Anyone Noticed. Your Coding Agent's Plugin Store Is the New npm.
**Source**: devto | **Metric**: Comments: 2
Names the exact mechanism — SHA pinned but never verified after checkout — and gives the blast radius: 26,000 agents for one PoC, 134,000 affected by SkillJacking. This is the spec for what a verifier must check.
### Salesforce Gave Its AI Agent Full CRM Access. An Attacker Weaponized It With a Web Form.
**Source**: devto | **Metric**: Comments: 1
Shows the same trust-boundary failure at enterprise scale (three zero-click Agentforce flaws, exfiltration via DNS). Broadens the buyer from individual devs to security teams already funding AI governance.
### Seep Reverse Lab — agent-native reverse engineering and CWE-602 authorization audit workbench
**Source**: github-trending | **Metric**: Stars: 475
475 stars for an agent-native offensive security workbench with 23 MCP tools confirms attacker-side automation for these exact authorization gaps is being productized now, not later.
### VibeDefend by CybeDefend
**Source**: producthunt | **Metric**: N/A (overall 7.5)
The closest current competitor launched with an install-time framing ('secure your Cursor and Claude Code') but ships runtime guarding — proof that demand exists and that the load-time verification layer is still unoccupied.
### ToolTrap: 'tool results are data' wasn't enough
**Source**: devto | **Metric**: Comments: 4
Quantifies why prompt-level guardrails cannot be the defense: a model presented planted data as 'verified support information' with an explicit rule against it. Only a deterministic, code-level check is trustworthy.
## Discovery
### Q1. What solo-founder products launched today?
**Signal**: Reddit r/SideProject: at least 8 solo-founder launch posts in one day — a water tracker whose cloud pet bonds with you (id 77959), AccessifyAI, a solo-built Shopify app checking stores against WCAG 2.2 (id 78137), AskLatte, an AI book library with sentence-level citations (id 77963), a 100% client-side WASM/Web Audio file converter (id 78134), VoxScribe local Windows dictation reporting its first sale after 6 weeks (id 78144), Plantyful plant-care plus pixel room game (id 78145), Happy Backlog's
**Analysis**: Today's solo-founder wave clusters on three narrow wedges: (1) privacy/local-first utilities that replace a cloud upload with browser or on-device compute (id 78134, id 78144, id 78149); (2) 'context memory' for AI chats, where every builder independently rebuilt the same persistent-context layer (id 77956, id 78130); and (3) regulated-compliance helpers sold to small merchants, e.g. the EU Accessibility Act deadline driving a WCAG scanner (id 78137). Distribution is almost entirely the r/SidePr
**Takeaway**: Build and ship a single-purpose, local-first utility in one of today's validated gaps — browser-side file conversion (id 78134) or WCAG/EAA remediation copy for small EU shops (id 78137) — and launch it directly on r/SideProject with the compliance deadline or 'no upload' guarantee as the headline; defer anything that needs a chat-context moat, since four separate founders already shipped that same week.
**Counter-view**: The Chrome-extension memory play (id 77956) competes head-on with ChatGPT's built-in custom instructions and memory, which ship free to every account with zero install friction, so an extension that stores background once is a feature, not a product. More broadly, of the solo launches listed today only two (id 77954, id 78144) report any revenue at all, mostly a single first sale.
### Q2. Which search terms or discussion threads are suddenly rising?
**Signal**: Hacker News: 'When did Google get so weird?' at 1584 points / 851 comments (id 77922), 'Owed a billion dollars in Nvidia stock' 935 / 395 (id 77970), Fireworks Research 'Ember-1' 548 / 235 (id 77923), 'Prompting Claude Opus 5.5' 85 / 75 (id 78102), 'Show HN: Lofi Cities' 300 / 119 (id 77926) and 'Show HN: TinyAIArena' 93 / 40 (id 77949). On Dev.to, 'Plugin4Shell Hit 26,000 Agents Before Anyone Noticed' (id 77889) and 'Salesforce Gave Its AI Agent Full CRM Access… SalesBleed' (id 77890) are movin
**Analysis**: Two distinct term clusters are accelerating. The first is search-quality decay and platform trust: the 1584-point, 851-comment Google thread (id 77922) is the highest-engagement item in the whole window, and Microsoft quietly dropping Copilot+ branding (id 77989) reads as the same trust story from the vendor side. The second, and more actionable for builders, is AI-agent supply-chain and permission security: plugin marketplaces as the new npm (id 77889, 26,000 agents), a CRM agent weaponized thr
**Takeaway**: Watch 'agent plugin supply chain' and 'agent permission scope' as the rising terms to build around this quarter, and ship a scoped-permission or plugin-signing check into any agent product before your users ask; defer generic 'Google search is bad' positioning, since that thread is venting with no purchase intent behind it.
**Counter-view**: Google's own distribution still dwarfs the complaint: a 1584-point HN thread is a rounding error against Google's daily query volume, and Microsoft's Copilot+ detach (id 77989) shows vendors rename rather than fix. Likewise the 'half of production agents are if-statements with a GPU bill' critique (id 78202) argues the security-plugin market may be selling into agents that will simply be deleted.
### Q3. Which open-source projects are growing fast but lack a commercial offering?
**Signal**: GitHub Trending: Niko1221/Strata at 880 stars — run a 125-billion-parameter model on one 12–24 GB NVIDIA card plus 64 GB RAM, one-click install on Windows or Linux (id 77864); yihui-dev/awesome-opus5-5-videos 627 stars (id 78040); lemomo-ai/lemo-opuscar 492 stars, 39 film styles each with a code-made short (id 77870); angusdevgo/Seep-Reverse-Lab 475 stars, agent-native multi-platform reverse engineering (id 77869); Liuziyu77/Valen 420 stars (id 77871); amitshekhariitbhu/ai-engineering-course 427
**Analysis**: Strata is the clearest commercial gap: 880 stars for a one-click local 125B-parameter runner speaks to a large audience that wants frontier-class inference without a cloud bill, and the project ships as an installer with no hosted tier, no support contract and no enterprise packaging. Seep-Reverse-Lab (475 stars) sits in the same shape — powerful, agent-native capability with no vendor, licensing or managed option. The two content repos (id 78040 at 627 stars, id 77870 at 492 stars) prove demand
**Takeaway**: Build a managed or supported wrapper around the local-inference gap Strata opens (id 77864) — a hosted control plane, hardware-profile auto-tuning, or a paid installer/support tier — and ship it before the repo's maintainer monetizes it or a funded competitor absorbs the category.
**Counter-view**: The space is already defended: Ollama and LM Studio own local-model running with millions of installs and funding, and llama.cpp's prompt-lookup work (id 77946, 64 points) keeps the free baseline improving weekly — Strata's 880 stars is a small fraction of that installed base, so a wrapper risks being a thin layer over software that is already free.
### Q4. What are developers complaining about today?
**Signal**: Hacker News: 'There is more to code review than (automatable) detection' 138 points / 86 comments (id 77928) and 'Footguns with Postgres "at time zone \'UTC\'"' 113 points / 56 comments (id 78107). Dev.to: 'Half the AI agents in production are if-statements with a GPU bill' with 6 comments (id 78202), 'AI Can Fix the Bug Before You Understand It — That's More Dangerous Than It Sounds' 4 comments (id 78217), 'ToolTrap: "tool results are data" wasn't enough' 4 comments (id 78205), and 'Before you
**Analysis**: The dominant complaint is a two-sided loss of developer comprehension. On the AI side, agents silently fix bugs the developer never understood (id 78217), absorb resume-driven frameworks that add a GPU bill for logic that is really an if-statement (id 78202), and still fail prompt-injection benchmarks even after being told tool results are data (id 78205). On the classic side, the 138-point code-review thread (id 77928) argues automated detection is being mistaken for review, and the 113-point P
**Takeaway**: Build an explanation-first artifact rather than another detector — a 'why did this break' diff and decision explainer that runs after an agent patch lands (id 78217), or a pre-commit check for the Postgres `at time zone 'UTC'` footgun (id 78107) — and ship the smallest version into an existing review flow instead of asking teams to adopt a new dashboard.
**Counter-view**: GitHub Copilot's built-in code review and the vendor-owned agent runtimes (id 78068 names three, including the author's Gobare) are already bundling exactly this visibility at zero marginal price; the 86 comments on id 77928 show reviewers consider detection table stakes, so a standalone explainer risks being bundled away, and the earlier Copilot+ branding retreat (id 77989, 18 points) shows how quickly vendor-side AI surfaces get renamed or dropped.
## Tech Radar
### Q5. What is the fastest-growing developer tool this week?
**Signal**: GitHub Trending: Niko1221/Strata has 880 stars, a one-click local AI runner that runs a 125B-parameter model on one NVIDIA 12-24GB GPU plus 64GB RAM.
**Analysis**: Strata is the clearest fast-rising developer tool in the set because it packages local large-model execution into a single install path for Windows and Linux. The 880-star GitHub Trending signal puts it above other GitHub-trending projects like lemo-opuscar at 492 stars and ai-engineering-course at 427 stars.
**Takeaway**: Watch Strata if you build local AI developer tooling; prototype a 125B-model workflow on a 12-24GB NVIDIA card before assuming cloud-only inference.
**Counter-view**: lemo-opuscar at 492 stars and ai-engineering-course at 427 stars show GitHub Trending is mixed with content and course repos, so Strata's 880 stars may reflect novelty as much as weekly growth.
### Q6. Which AI models, frameworks, or infrastructure deserve attention?
**Signal**: Hacker News: Ember-1 scored 548 with 235 comments; GitHub Trending: Strata has 880 stars for running a 125B model on a gaming PC.
**Analysis**: Ember-1 from Fireworks Research is framed as half the tokens for the same answers, which is a direct inference-cost claim, and its 548/235 HN signal shows high discussion. Strata complements that by pushing large-model execution to local GPUs, while Hugging Face models like TeleOCR and Jev-Omni indicate ongoing multimodal OCR and decision-classifier experimentation.
**Takeaway**: Evaluate Ember-1 for token-cost reduction and watch Strata for local inference; defer architecture bets until you reproduce claims on your own workload.
**Counter-view**: Claude Opus 5.5 has a prompting guide at score 85 and comments 75, showing incumbent model attention remains strong; Ember-1 may be a launch spike rather than a production-proven replacement.
### Q7. Which platforms, products, or technologies are declining?
**Signal**: Hacker News: Microsoft drops Copilot+ branding from its new laptops scored 18 with 5 comments; When did Google get so weird? scored 1584 with 851 comments.
**Analysis**: The Copilot+ branding removal is a retreat signal for Microsoft's hardware-level AI positioning. The much larger Google search thread shows sustained platform-quality frustration, but the Copilot+ item is the concrete product and branding decline.
**Takeaway**: Defer Microsoft Copilot+ hardware bets as a differentiator; watch whether Copilot features survive as software rather than laptop branding.
**Counter-view**: Microsoft still ships Copilot software, and the Copilot+ branding story has only 18 points and 5 comments, far below the Google thread's 1584 and 851, so this is a branding retreat rather than platform collapse.
### Q8. What tech stacks are successful Show HN / GitHub projects using?
**Signal**: Hacker News Show HN: Lofi Cities scored 300 with 119 comments; Show HN: PaperMono scored 52 with 17 comments; GitHub Trending: Strata has 880 stars.
**Analysis**: Lofi Cities uses browser-generated lofi and pixel-art city nights, PaperMono uses an M5Stack PaperMono ESP32-S3 e-ink touchscreen with Wi-Fi sync, offline support, and about 2,400 lines of C++, and Strata uses one NVIDIA 12-24GB GPU plus 64GB RAM for local 125B-model execution. Successful projects are local-first, edge-oriented, or browser-native generative media.
**Takeaway**: Build local-first edge AI or browser-native generative media prototypes; ship ESP32-S3 e-ink companions with web sync and offline fallback.
**Counter-view**: Show HN: Free alternative to graphics design giants scored only 31 with 8 comments, showing that a WebAssembly design-tool stack attracts much less traction than Lofi Cities at 300 and 119.
## Competitive Intel
### Q9. What pricing and revenue models are indie developers discussing?
**Signal**: Reddit r/SideProject id=77966 (score 6.9) 'what's actually working for monetizing web dev tutorials now?' questions affiliate links and sponsorships; Dev.to id=77891 compares Gemini 3.8 Flash / Flash Cyber vs Muse Spark 1.3 on raw cost; Hacker News id=77980 'As A.I. makes law firms more efficient, clients ask: Where's my discount?' (score 65, 40 comments) shows buyers demanding cost pass-through; Reddit id=78134 (score 6.5) rejects the '2 files per day' paywall with a 100% client-side converter;
**Analysis**: Three pricing narratives dominate today: (1) legacy monetization for content (affiliate links, sponsorships) is decaying and being replaced by paid bundles, templates, or sponsored tool integrations; (2) AI cost is being passed through and compared explicitly per model (Gemini 3.8 Flash vs Muse Spark 1.3), so token economics is becoming the buyer's negotiation lever, as the 40-comment law-firm discount thread shows; (3) artificial usage caps ('2 files per day', design-tool subscriptions) are bei
**Takeaway**: Build a metered or one-time price with a visible cost breakdown per model call, ship a free local-first tier as the top of funnel, and defer affiliate/sponsorship-only monetization for content products.
**Counter-view**: Usage pricing is not a slam dunk: Product Hunt's 'Okara' (id=78070) still launches as a subscription-style 'AI CMO', and id=77953 shows devs arbitraging Claude's 5-hour usage window across shared accounts rather than paying metered rates, while id=78068 warns that idle-time billing punishes hosted runtime vendors.
### Q10. What migration, replacement, or "X is dead" trends are emerging?
**Signal**: Hacker News id=77989 'Microsoft drops Copilot+ branding from its new laptops' (score 18, 5 comments); Dev.to id=78202 'Half the AI agents in production are if-statements with a GPU bill' (Comments: 6) argues agent frameworks are resume-driven overkill; Hacker News id=77923 Ember-1 'half the tokens, same answers' (score 548, 235 comments) pitches replacing token-heavy models; Dev.to id=78051 (Comments: 8) frames traditional task tracking being replaced by AI-agent workflows; Product Hunt id=78085
**Analysis**: Four replacement currents appear today. First, branding retreat: Microsoft silently dropping Copilot+ from new laptops signals the AI-brand suffix is no longer a selling point and may be a liability. Second, framework retrenchment: the 'if-statements with a GPU bill' argument says teams are migrating off heavy agent frameworks back to plain code with a single model call. Third, model substitution: Ember-1's 'half the tokens, same answers' pitch is a direct replacement claim against incumbent hig
**Takeaway**: Build model-agnostic routing and token-cost portability into anything LLM-facing, pass on framework-heavy agent stacks until they show idle-cost discipline, and watch Copilot+-style branding retreats as a leading indicator of consolidation.
**Counter-view**: Framework and branding layers still have backers: Product Hunt shipped 'MCP Connectors by Databox' (id=78073) and 'VibeDefend by CybeDefend' (id=78080) as new agent infrastructure, and Ember-1 (id=77923, 235 comments) still required Fireworks Research's full serving stack to deliver its token savings, so the migration is toward cheaper plumbing, not fewer layers.
### Q11. Which old projects or legacy needs are suddenly coming back?
**Signal**: Hacker News id=77937 'S3 Is the Future, S3 Is the Past' (score 38, 25 comments); Hacker News id=78107 'Footguns with Postgres "at time zone \'UTC\'"' (score 113, 56 comments); Hacker News id=77922 'When did Google get so weird?' (score 1584, 851 comments); Hacker News id=78257 PaperMono e-ink fridge-magnet shopping list (score 52, 17 comments, ~2,400 lines of C++); Reddit id=78134 (score 6.5) client-side WASM + Web Audio converter.
**Analysis**: Legacy needs are resurfacing along two axes. Infrastructure: S3 and Postgres timezone semantics are being re-litigated by developers who assumed managed abstractions removed them, meaning fundamentals knowledge (object-storage primitives, UTC handling) is back in demand. Local-first and offline: an e-ink fridge-magnet list running offline on an ESP32-S3 and a client-side WASM file converter both reject cloud round-trips, reviving pre-cloud desktop/embedded patterns under a privacy and latency ba
**Takeaway**: Build local-first, client-side processing as a differentiator and ship legacy-infra guardrails (S3 semantics, Postgres timezone handling) as content or tooling, while watching the Google-sentiment thread for demand in curated discovery.
**Counter-view**: The legacy revival is contested inside its own evidence: id=77937's 25 comments split on whether S3 is the future or the past, and id=77922's 851 comments express frustration with Google without naming a replacement search engine at comparable scale, so treating 'old is back' as a market shift is premature.
## Trends
### Q12. What are the highest-frequency keywords this week?
**Signal**: Across Hacker News, dev.to, Reddit and Product Hunt, the dominant keyword cluster is 'AI coding agent' + 'agent security/observability': HN 'There is more to code review than (automatable) detection' at 138 points / 86 comments (id 77928); dev.to 'Half the AI agents in production are if-statements with a GPU bill' (id 78202, 6 comments); Product Hunt ships 'vantage.ai — See and control what your coding agent does' (id 78090, overall=6.7) and 'VibeDefend — the one command line to secure your Curs
**Analysis**: The word 'agent' has moved from a demo noun to an infrastructure noun. This week it is almost always qualified by a control verb — secure, watch, control, govern, route — which means the conversation has shifted from 'can agents do X' to 'who is accountable when they do X'. A second tier of keywords ('plugin', 'MCP', 'tool result', 'supply chain') clusters around the same theme: the agent's tool surface. A third tier ('context', 'memory', 're-explain') captures the pain of statelessness across C
**Takeaway**: Build for the agent control plane this week, not the agent itself: ship an observability or permission layer that sits between a coding agent and its tools/plugins, because that is where the repeated keyword demand is concentrated.
**Counter-view**: Microsoft dropped the 'Copilot+' branding from its new laptops (HN 18 points / 5 comments, id 77989), which is a reminder that keyword heat around agent branding can evaporate faster than the underlying tooling — betting on the label rather than the control layer is a losing trade.
### Q13. Which concepts are cooling down?
**Signal**: Three concepts show decay: (1) AI product badging — HN 'Microsoft drops Copilot+ branding from its new laptops' at only 18 points / 5 comments (id 77989); (2) legacy tutorial monetization — Reddit 'what's actually working for monetizing web dev tutorials now?' explicitly states affiliate links and sponsorships 'aren't as reliable anymore' (id 77966, overall=6.9); (3) resume-driven AI stacking — dev.to 'Half the AI agents in production are if-statements with a GPU bill' attacks picking 'an agent
**Analysis**: The cooldown is not in AI itself; it is in any AI concept that is a label without a measurable outcome. 'Copilot+' as a sticker, 'vector DB' as a default architecture choice, and 'AI monetization' as an assumed revenue path are all losing air. Meanwhile the adjacent concepts with hard numbers — token cost, replay bugs, idle runtime behavior, RCE counts — are gaining. This is the classic hype-to-instrumentation transition.
**Takeaway**: Defer anything whose pitch is a vendor badge, a default vector DB, or an affiliate-tutorial funnel, and re-point that effort at cost, security or reliability measurements that buyers can verify.
**Counter-view**: Model-brand keywords are not cooling: 'Prompting Claude Opus 5.5' still pulled 85 points / 75 comments on HN (id 78102), so Claude and Gemini branding retains pull even as Microsoft's Copilot+ badge loses it.
### Q14. Which new terms or categories are emerging from zero?
**Signal**: Four zero-to-one terms appear this week: 'Plugin4Shell', a zero-click RCE vulnerability class said to have hit 26,000 agents across Claude Code, Codex, Copilot and Gemini CLI (id 77889, overall=7.9); 'SalesBleed', an enterprise AI-agent weaponization disclosure against Salesforce (id 77890, overall=7.6); 'ToolTrap', a new benchmark category testing whether agents obey injected tool results (id 78205, overall=7.2, 4 comments); and 'Backstory', a persistent-context Chrome extension category that p
**Analysis**: This week produced actual coinages rather than rephrasing. Plugin4Shell and SalesBleed repurpose familiar naming conventions (Shellshock/Heartbleed-style) to claim a new attack-surface category: agent plugin marketplaces and CRM-connected agents. ToolTrap is a benchmark label, which is the earliest sign a category is becoming comparable. Backstory is a product-level label for a pain that had no name — 're-explaining myself to every model'.
**Takeaway**: Ship a scanner or policy gate for agent plugin marketplaces now, and watch ToolTrap-style tool-result injection tests as the acceptance criteria enterprise buyers will start asking for.
**Counter-view**: Salesforce has not confirmed a breach named 'SalesBleed' and Microsoft is already retreating from Copilot branding (id 77989, 18 points), so naming a vulnerability class is not the same as a durable market — Claude Code and Codex plugin stores remain the incumbents that must be broken for this category to harden.
## Action
### Q15. What is most worth spending 2 hours on today?
**Signal**: Dev.to: 'Plugin4Shell Hit 26,000 Agents Before Anyone Noticed' (id 77889) scored 7.9 overall with 2 comments and documents a zero-click RCE across Claude Code, Codex, Copilot and Gemini CLI; the companion Dev.to post 'Salesforce Gave Its AI Agent Full CRM Access' (id 77890) scored 7.6 with 1 comment.
**Analysis**: Two of today's top three Dev.to items are about the same failure mode: agent plugin marketplaces have inherited every package-manager supply chain pattern, and a single plugin event reached 26,000 agent installs before anyone noticed. The 77889 write-up explicitly frames the plugin store as 'the new npm', which means the defensive primitives developers already trust (lockfiles, SBOMs, provenance, allowlists) simply do not exist yet for agent plugins. Spend the two hours writing a scanner that wa
**Takeaway**: Build the two-hour 'agent plugin audit' CLI today: enumerate installed plugins across Claude Code, Codex, Copilot and Gemini CLI, flag unpinned or unsigned entries, and emit a lockfile proposal from the Plugin4Shell (id 77889) attack surface.
**Counter-view**: The 26,000-install figure comes from a single vendor-disclosure narrative (id 77889, only 2 comments) and the accompanying Salesforce case (id 77890, 1 comment) is also a sponsored-style disclosure, so the vulnerability class may be far narrower in practice than the framing suggests.
### Q16. Why not the other two candidate directions?
**Signal**: Reddit memory-layer posts: 'Built a free Chrome extension because I got tired of retyping my business context' (id 77956, overall 7.9) and 'I built a shared memory for all my AI agents' (id 78130, overall 7.3); Shopify accessibility app AccessifyAI (id 78137, overall 7.7) cites the European Accessibility Act from June 2025.
**Analysis**: Direction two (cross-tool persistent memory) is already a two-horse-plus race decided on distribution, not code: id 77956 is a free Chrome extension and id 78130 is a solo shared-memory layer, both shipping zero-retention positioning for the same 're-explaining myself' pain. You cannot win a free-extension land grab in a weekend. Direction three (EU Accessibility Act compliance for Shopify) has the strongest regulatory hook but the worst two-hour economics: id 78137 is a solo Shopify app checkin
**Takeaway**: Pass on the memory layer (id 77956, 7.9; id 78130, 7.3) and defer the accessibility compliance app (id 78137, 7.7) to a later sprint; commit the two hours to the agent plugin audit instead.
**Counter-view**: VibeDefend already claims 'the one command line to secure your Cursor and Claude Code' (Product Hunt, id 78080, 7.5), so the entry point I am choosing may already be taken while the neglected memory-layer post (id 77956) sits at a higher 7.9.
### Q17. What is the fastest validation step?
**Signal**: Dev.to Plugin4Shell (id 77889, overall 7.9, 2 comments) names Claude Code, Codex, Copilot and Gemini CLI as the affected hosts; Product Hunt VibeDefend (id 78080, overall 7.5) already ships a one-command scanner for Cursor and Claude Code.
**Analysis**: The fastest validation is a scan, not a product. Run the audit script against three real machines (or three fresh containers) with agents installed, count how many plugins/MCP servers are unpinned, unsigned or granted filesystem/network scope beyond what their manifest declares, and publish the raw table with the 26,000 figure from id 77889 as context. The measurable output is 'N plugins installed, M unpinned, 0 with provenance metadata'. If M is large, the lockfile is a product; if M is near ze
**Takeaway**: Ship the raw scan today and publish the unpinned/unsigned plugin counts from three real installs; watch the response before writing any UI or policy engine.
**Counter-view**: VibeDefend (id 78080) has already shipped the 'one command line' framing, so a scan-only result risks being read as a worse version of an existing 7.5-scored tool rather than as new evidence.
### Q18. What product should this become over the weekend?
**Signal**: Product Hunt: vantage.ai (id 78090, overall 6.7) 'See and control what your coding agent does.'; VibeDefend (id 78080, overall 7.5) 'The one command line to secure your Cursor and Claude Code.'; Dev.to 'ToolTrap: tool results are data wasn't enough' (id 78205, overall 7.2 with 4 comments) benchmarks whether a support agent can ignore a fake injected detail.
**Analysis**: Ship it as the lockfile + provenance gate for agent plugins: (1) `audit` command producing a signed SBOM of installed plugins and their declared scopes, (2) an `agent-plugins.lock` committed to the repo that pins version plus hash plus publisher identity, (3) a CI check that fails the build when the lock drifts, and (4) a one-screen diff view showing what scope a plugin gained between two lock revisions. That is deliberately narrower than vantage.ai's general 'see and control' control plane (id
**Takeaway**: Build the weekend MVP as an agent-plugin lockfile plus CI drift gate plus scope-diff view, and ship the CLI before any dashboard.
**Counter-view**: vantage.ai (id 78090, 6.7) already markets the full see-and-control surface, so a weekend project limited to the lockfile risks being absorbed as a feature of that control plane instead of standing alone.
### Q19. How should initial pricing and packaging look?
**Signal**: Product Hunt tiering today: VibeDefend (id 78080, 7.5), Arc (id 78074, 6.1), Harness Router (id 78079, 5.9), Zerg Router (id 78085, 6.4); Reddit 'Made my first sale today after 6 weeks of building' for VoxScribe (id 78144, overall 5.9) shows how slow individual-dev monetization is.
**Analysis**: Free forever, MIT-licensed CLI and lockfile format — the lockfile only has value if it is ubiquitous, and the 26,000 affected installs from id 77889 need to be able to run it without a sales call. Charge at the team boundary: a $12-15 per seat per month hosted policy plane that centralizes the lockfile across repos, enforces publisher allowlists, keeps scan history, and alerts on new scope grants. Add a one-time $490-990 repo audit for teams that need a written provenance report before a securit
**Takeaway**: Ship the CLI free and open source this weekend, then package the paid tier at the team level (per-seat policy plane plus a fixed-fee repository audit) rather than chasing solo-dev subscriptions.
**Counter-view**: The Product Hunt field today already prices broad agent tooling cheaply — Harness Router (id 78079, 5.9) and Zerg Router (id 78085, 6.4) are routing utilities at utility prices — so even a $12-15 seat price may meet a market that expects the whole category to be near-free.
### Q20. What is the strongest counter-view?
**Signal**: Dev.to 'Gemini 3.8 Flash and Flash Cyber vs Muse Spark 1.3: what they cost' (id 77891, overall 6.8, 2 comments) describes a model version 'tuned to find and patch vulnerabilities that you cannot buy'; HN 'Microsoft drops Copilot+ branding from its new laptops' (id 77989, score 18, 5 comments) shows how fast vendor security branding churns.
**Analysis**: The strongest counter-view is that install-time plugin provenance gets absorbed by the platform vendors rather than sold as a third-party tool. Model providers are already shipping security-tuned variants (id 77891 describes Gemini 3.8 Flash Cyber, a version tuned to find and patch vulnerabilities), and the branding churn on the Microsoft side (id 77989, score 18) shows vendors are willing to rename and re-bundle this surface repeatedly. If Anthropic, OpenAI, Google or Microsoft ship signed plug
**Takeaway**: Build the lockfile as a documented cross-vendor format and watch for a vendor-shipped signing announcement; if Anthropic or OpenAI ships native plugin provenance, pivot the product to the multi-host audit report instead of the CLI.
**Counter-view**: Gemini 3.8 Flash Cyber (id 77891, 6.8) already bundles vulnerability-finding into the model itself, which is the clearest failure case for a standalone plugin-security tool.
## Action Plan
**2-Hour Build**: One Node/Python CLI with a single command: `skilllock scan`. It discovers agent plugin and skill directories (Claude Code, Codex, Copilot, Gemini CLI paths plus a `--dir` override), reads each plugin manifest for the pinned commit SHA, then runs three checks per plugin: (1) `git rev-parse HEAD` vs the pinned SHA, (2) `git status --porcelain` for uncommitted mutation, (3) a normalized tree hash over the checked-out files compared to the value stored in `.skilllock.lock` on first run. Output a com
**Why This Wins**: The vulnerability is a verification gap with a deterministic answer, not a detection problem. You do not need a model, a signature feed, or an agent hook: either the checked-out tree matches the approved commit or it does not. That means the tool is instant, offline, free of false-positive tuning, and works identically across all four affected agents because it operates at the git layer rather than the vendor API layer. Incumbents are selling observation of agent behavior; this sells a proof abo
**Why Not Alternatives**:
- Runtime agent monitors (vantage.ai, VibeDefend): they observe tool calls after the plugin is already loaded and executing inside the agent process — Plugin4Shell's 26,000-agent spread happened at install and update time, before a single call reached a monitor.
- Waiting for vendor fixes: Google deprecated Gemini CLI instead of patching it and GitHub Copilot shipped no fix at disclosure, so at best half the affected agents get a vendor answer, and none of them verify third-party skills the user installed themselves.
- Generic SCA and package scanners (Dependabot, npm audit): they have no concept of an agent plugin manifest, no model of 'pinned SHA that is never verified against checkout', and no visibility into the skill directories where SkillJacking's 925 hijacks landed.
- Prompt-level defenses ('tool results are data, not instructions'): ToolTrap showed a model relaying a planted callback number as verified support information despite exactly that rule — an instruction cannot be a security boundary.
**Fastest Validation**: Publish a numbered scan of the top 100 skills in the most popular agent marketplace with the raw JSON attached, then post it as a reply in the Plugin4Shell thread and on r/SideProject with a title that states the number, not the product. Ship the CLI on npm in the same post so the first comment can be 'I ran it against my setup' rather than 'interesting idea'. Second, DM five DevRel or security engineers at teams from the recurring agent-governance posts and offer to run the scan on their intern
**Weekend Expansion**: Add the GitHub Action (`skilllock verify` as a required check that fails when a plugin tree hash changes without a lockfile bump), a signed-attestation mode where the normalized tree hash is HMAC'd with a team key and recorded in the lockfile, a background drift watcher that re-hashes installed skill directories and alerts on content or mtime changes, and CycloneDX/SPDX export so security teams can reconcile agent plugins against the inventory they already maintain.