--- title: "Armor1 (@armor1) | Hashnode" description: "Armor1 (@armor1) writes on Hashnode. Read their latest articles and follow their work." url: "https://hashnode.com/@armor1" --- @armor1 # Armor1 @armor1 · San Francisco, USA · Joined April 2026 ### [How to Audit Your AI Agent Skills for Credential Exposure and Malicious Instructions](https://armor1.hashnode.dev/how-to-audit-your-ai-agent-skills-for-credential-exposure-and-malicious-instructions?utm_source=hashnode&utm_medium=feed) Two independent security research groups published this week with findings that land on the same problem from different angles: AI agent skill files are a serious and underaudited supply chain surface 4 min read · [armor1.hashnode.dev](https://armor1.hashnode.dev/how-to-audit-your-ai-agent-skills-for-credential-exposure-and-malicious-instructions?utm_source=hashnode&utm_medium=feed) [May 15](https://hashnode.com/posts/how-to-audit-your-ai-agent-skills-for-credential-exposure-and-malicious-instructions/6a066c87baf09db7a6507e16) ### [What "Code That Runs Before You Click Trust" Means for AI Coding Tools (Claude Code Case Study)](https://armor1.hashnode.dev/what-code-that-runs-before-you-click-trust-means-for-ai-coding-tools-claude-code-case-study?utm_source=hashnode&utm_medium=feed) The trust dialog in an AI coding tool is supposed to be the security boundary that gates everything the agent does inside a workspace. External security researchers recently published a technical writ 4 min read · [armor1.hashnode.dev](https://armor1.hashnode.dev/what-code-that-runs-before-you-click-trust-means-for-ai-coding-tools-claude-code-case-study?utm_source=hashnode&utm_medium=feed) [May 12](https://hashnode.com/posts/what-code-that-runs-before-you-click-trust-means-for-ai-coding-tools-claude-code-case-study/6a03bdea937b84f779dfa977) ### [How to Check if You're Affected by CVE-2026-26268 in Cursor (and What to Do)](https://armor1.hashnode.dev/how-to-check-if-you-re-affected-by-cve-2026-26268-in-cursor-and-what-to-do?utm_source=hashnode&utm_medium=feed) CVE-2026-26268 is a CVSS 8.1 high-severity vulnerability in the Cursor AI IDE that lets a malicious repository execute arbitrary code on a developer's machine the moment Cursor's agent performs a Git 4 min read · [armor1.hashnode.dev](https://armor1.hashnode.dev/how-to-check-if-you-re-affected-by-cve-2026-26268-in-cursor-and-what-to-do?utm_source=hashnode&utm_medium=feed) [May 10](https://hashnode.com/posts/how-to-check-if-you-re-affected-by-cve-2026-26268-in-cursor-and-what-to-do/6a00361ae3eebc2e20495b80) ### [How to Check If Your Claude Code Installation Is Affected by CVE-2026-39861 (CVSS 7.7)](https://armor1.hashnode.dev/how-to-check-if-your-claude-code-installation-is-affected-by-cve-2026-39861-cvss-7-7?utm_source=hashnode&utm_medium=feed) CVE-2026-39861 is a sandbox escape in Claude Code, patched in version 2.1.64. The vulnerability allows file writes to land outside the workspace directory by exploiting symbolic link following across 3 min read · [armor1.hashnode.dev](https://armor1.hashnode.dev/how-to-check-if-your-claude-code-installation-is-affected-by-cve-2026-39861-cvss-7-7?utm_source=hashnode&utm_medium=feed) [May 8](https://hashnode.com/posts/how-to-check-if-your-claude-code-installation-is-affected-by-cve-2026-39861-cvss-7-7/69fd4b919f93a850a44dc09a) ### [How to Check Your MCP Server for CVE-2026-5603's Vulnerability Pattern (And Why shellQuote Isn't Enough)](https://armor1.hashnode.dev/how-to-check-your-mcp-server-for-cve-2026-5603-s-vulnerability-pattern-and-why-shellquote-isn-t-enough?utm_source=hashnode&utm_medium=feed) CVE-2026-5603 is a Critical command injection in @elgentos/magento2-dev-mcp, but the vulnerability pattern it represents shows up in community MCP servers regularly. This post explains what the vulner 4 min read · [armor1.hashnode.dev](https://armor1.hashnode.dev/how-to-check-your-mcp-server-for-cve-2026-5603-s-vulnerability-pattern-and-why-shellquote-isn-t-enough?utm_source=hashnode&utm_medium=feed) [Apr 22](https://hashnode.com/posts/how-to-check-your-mcp-server-for-cve-2026-5603-s-vulnerability-pattern-and-why-shellquote-isn-t-enough/69e8123ee436727814b38adb)