StepSecurity has added an Agent Skills inventory feature to Dev Machine Guard, giving security teams fleet-wide visibility into AI coding agent skills installed on developer machines. The feature covers agents like Claude Code, Codex, GitHub Copilot, and Cursor, flagging skills that contain executable code, hooks, or shell commands. It also traces provenance, detects version drift across devices, and provides per-device installation detail. The announcement highlights real-world attacks — including the ClawHavoc campaign that planted 1,184 malicious skills and Snyk's ToxicSkills research finding 36% of public skills had security flaws — to underscore why inventory and governance of AI agent skills is now a critical security concern for enterprises.
