product1 publisher
One unauthenticated GET request inflates install counts on an AI agent skills marketplace
Orca Security found four abuse paths in one of the biggest AI agent skills marketplaces. The install counter accepts unauthenticated requests, and the security audit only reruns once a skill gets popular.
Publishers:orca.security
Reality
- Evidence48
- Adoption22
- Hype gap+18
- Incentives65
- Confidence55