Malicious AI Skills, Plugins, MCP, and Desktop Trust-Boundary Attacks

Research reports 253 bugs across 118 MCP servers, and extension execution or runtime-fetched code can evade repository pinning. LiteLLM alleges some Claude Code responses exposed GitHub CLI OAuth tokens used in a compromise; a separate outbound-email disclosure report links to an Anthropic issue but has no reproduction or clear resolution. CI hardening favors full-SHA pins and narrowly scoped permissions; hooks can fail open, and ownership plugins are not security controls.