We security-scanned 104 agent skill repos and MCP servers. Here's what we found.
Agent skills and MCP servers are the new npm packages: one line in a config file and an AI agent gains a new capability, plus whatever else the code does. Before adding items to the Agent Coach librar