Morfeu333

Coding Agent Security Checklist — Security skill for Claude Code

Security community

Stop your AI coding agent (Claude Code, Cursor, Codex) from installing malware straight out of llms.txt documentation — a copy-paste AGENTS.md policy against the supply-chain attack researched by Alon.

How to install Coding Agent Security Checklist

This entry records only its repository, not the path inside it, so there is no exact command to give. Open Morfeu333/coding-agent-security-checklist and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Coding Agent Security Checklist does

Alternatives in Security

OpenTag — Open-source, channel-native agent gateway for Slack 499 ★
Skill Threat Modeling — Code-First Deep Risk Analysis Skill for Claude Code - 8-Phase Workflow with Security design review, STRIDE Thr 207 ★
Vibeship Scanner — a free vulnerability and security scanner for vibe coders, with 2000+ rulesets, and copy pasteable Master AI F 120 ★

README

Coding Agent Security Checklist

**Stop your AI coding agent from installing malware straight out of documentation it was never supposed to trust.**

The problem

Security researcher Alon Hertz scanned over 6,000 live domains belonging to Fortune 500 companies, defense contractors, and big tech, and found more than 8,000 `llms.txt` files — the emerging convention websites use to hand AI agents machine-readable instructions (think of it as the AI equivalent of `robots.txt`).

Buried inside 120 of those files, on 120 different sites, were references to code packages and domains that **nobody had actually registered** — 227 install commands pointing at names that simply didn't exist. Most likely hallucinated by an AI agent at some point, and never cleaned up.

Hertz registered a handful of those unclaimed package names and domains himself, wired them to quietly phone home on install, and waited.

4 minutes for the first Fortune 500 machine to run the code.
Dozens more companies followed over the next few days.
The parent process chain showed exactly what triggered it: coding agents like Claude, Codex, and Hermes, executing code that no human at those companies ever reviewed or approved.
In at least one case, the unclaimed name pointed to an already-live malware package.

None of this required a CVE, a phishing email, or breaching a perimeter. The agents just did what they're built to do: read a trusted-looking file, find an install command, and run it.

Full research: [*Data Became Code: We Ran Code Inside Fortune 500s Using Files They Published for AI Agents*](https://medium.com/@alonhertz1/data-became-code-we-ran-code-inside-fortune-500s-using-files-they-published-for-ai-agents-0cd67ffbbffc) — Alon Hertz, Medium, Aug 2026.

The fix

The vulnerability isn't really in Claude, Codex, or Hermes individually — it's in the fact that **nobody's verifying the destination before the code executes**. Coding agents don't have a native way to check whethe