Research · curated 28 Jun 2026
Your Agent Risk Isn't in One Plugin. It's in the Composition.
First reported openaca.dev
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
It shows defenders that agent supply-chain risk lies in how MCP servers, skills, and dependencies combine to expose untrusted-input-to-sensitive-capability paths that package-level scanners cannot detect.
OpenACA analyzes how agentic AI risk emerges from the composition of plugins, MCP servers, skills, and npm dependencies rather than any single component, using the Claude Code 'imessage' plugin as an example (a local MCP server reading chat.db, sending iMessages, with skills that rewrite access policy). They scanned the official Claude plugin marketplace (62 manifests, 530 components) and found all 124 known-vulnerability advisories clustered in the four message-channel plugins (discord, telegram, fakechat, imessage) that ingest untrusted input and can exfiltrate local files, arguing SCA and runtime monitoring miss this composition-level exposure.