Research
Your Agent Risk Isn't in One Plugin. It's in the Composition.
Publication date not yet evaluated · Added openaca.dev
Page published
Coverage timeline
Single-source research — one report is available.
Why it matters
It shows defenders that agent supply-chain risk lies in how MCP servers, skills, and dependencies combine to expose untrusted-input-to-sensitive-capability paths that package-level scanners cannot detect.
OpenACA analyzes how agentic AI risk emerges from the composition of plugins, MCP servers, skills, and npm dependencies rather than any single component, using the Claude Code 'imessage' plugin as an example (a local MCP server reading chat.db, sending iMessages, with skills that rewrite access policy). They scanned the official Claude plugin marketplace (62 manifests, 530 components) and found all 124 known-vulnerability advisories clustered in the four message-channel plugins (discord, telegram, fakechat, imessage) that ingest untrusted input and can exfiltrate local files, arguing SCA and runtime monitoring miss this composition-level exposure.