A supply-chain audit finds security defects in 16% of public coding-agent configs

'Scanning the Harness' audits 3,171 public GitHub repositories (2,600 Claude Code / Cursor / Copilot / Codex configurations and 511 published skill sets), with every finding independently re-derived and dual-adjudicated: 9.8% install unpinned MCP servers; 3.1% pre-approve arbitrary execution behind seemingly scoped grants; 3.8% of skills carry pre-approved shells; 16.0% of configurations carry at least one security defect (25.5% raw scan rate). No confirmed credential exposure was found. Tools, corpus manifest, prompts and adjudications are released.

This is the first quantified security audit of the emerging MCP/skills config supply chain — the numbers say one in six public agent configs ships a defect class for which no lockfiles, install-time checks or capability vocabulary exist yet. Teams curating shared MCP configs or skill libraries should pin versions and add install-time review; platform vendors now have a measured baseline to design against.