{"_canonicalization":{"envelope_id":"axm_ + sha256(envelope minus {signature, axiom_id, anchors})","envelope_signature":"ed25519(envelope minus {signature, axiom_id})","json":"sort_keys=True, separators=(',',':'), ensure_ascii=False, allow_nan=False, utf-8","leaf_hash":"sha256(0x00 || canonical_json(envelope_full))","seal_signature":"ed25519(seal minus {signature, sig_algorithm})"},"axiom_id":"axm_18dabaf4fd2e9fe3bdda111684094698f19a006c86588a10276732f8552c9feb","bitcoin_anchor":{"bitcoin_attestations":[],"calendar_attestations":[],"ots_url":"","stamped_at":"","status":"pending_next_stamp"},"envelope":{"anchors":[{"chain":"crovia.axiom_graph","height":0,"merkle_proof":"spider_vendor_press_v1","root_at_anchor":"spider_vendor_press_v1"}],"axiom_id":"axm_18dabaf4fd2e9fe3bdda111684094698f19a006c86588a10276732f8552c9feb","axiom_type":"AX.OBS","body":{"axiom_subtype":"news.vendor_press.v1","category":"news","fingerprint":"c0894cd113f8dfc02967daf9b9a0b73fc8b034468e20efa273a8d9cf1ef55e5c","published":"Thu, 28 May 2026 00:00:00 -0400","receipt_hash":"c0894cd113f8dfc02967daf9b9a0b73fc8b034468e20efa273a8d9cf1ef55e5c","schema":"spider.news.vendor_press.v1","spider":"vendor_press","spider_record":{"axiom_subtype":"news.vendor_press.v1","category":"news","decision_hint":"POSITIVE","envelope_target":"AX.OBS","fingerprint":"c0894cd113f8dfc02967daf9b9a0b73fc8b034468e20efa273a8d9cf1ef55e5c","observed_at":"2026-05-28T04:43:38.862500Z","parent_run_hash":"58f8b4a134069e0a15ea3949252489597eb86dd27c9ca3fb15c6fb838ce49ef3","published":"Thu, 28 May 2026 00:00:00 -0400","runtime_version":"0.1.0","schema":"spider.news.vendor_press.v1","source_status":200,"source_url":"https://export.arxiv.org/rss/cs.AI","spider":"vendor_press","summary_excerpt":"arXiv:2605.28588v1 Announce Type: cross \nAbstract: We analyzed 3,984 AI agent skills from major marketplaces and found 76 confirmed malicious payloads, including credential theft, backdoor installation, and data exfiltration. 13.4% of all skills contain at least one critical-level security issue and at least 8 manually confirmed malicious skills remain publicly available on clawhub.ai as of the date of publication. This report documents our methodology, presents a threat taxonomy based on real-world samples, and details the attack patterns we observed. As skill marketplaces grow rapidly and AI agents gain access to sensitive credentials and systems, automated security analysis is no longer optional.","title":"Technical Report: Exploring the Emerging Threats of the Agent Skill Ecosystem","url":"https://arxiv.org/abs/2605.28588","vendor":"arxiv_cs_ai"},"summary":"arXiv:2605.28588v1 Announce Type: cross \nAbstract: We analyzed 3,984 AI agent skills from major marketplaces and found 76 confirmed malicious payloads, including credential theft, backdoor installation, and data exfiltration. 13.4% of all skills contain at least one critical-level security issue and at least 8 manually confirmed malicious skills remain publicly available on clawhub.ai as of the date of publication. This report documents our methodology, presents a threat taxonomy based on real-world samples, and details the attack patterns we observed. As skill marketplaces grow rapidly and AI agents gain access to sensitive credentials and systems, automated security analysis is no longer optional.","title":"Technical Report: Exploring the Emerging Threats of the Agent Skill Ecosystem","vendor":"arxiv_cs_ai"},"confidence":{"method":"deterministic"},"decision":"POSITIVE","issued_at":"2026-05-28T04:43:38Z","notes":"Spider vendor_press (news) news.vendor_press.v1","object":{"captured_by":"crovia.spider.vendor_press","primary_source_url":"https://arxiv.org/abs/2605.28588"},"predecessors":[],"schema":"crovia.axiom.v1","signature":"ed25519:dcb8eaa16b7a31c6c2f2f09dec13a65603ec16f66bd07dedf33258be95f2faf9c24b2879696a8ad9559db04593c076ce1637414ac60a9c5e7f6582134e9ad40d","signer":"crovia.substrate","subject":{"observed_at":"2026-05-28T04:43:38Z","source_collector":"spider:vendor_press","target_id":"https://arxiv.org/abs/2605.28588"},"tsa":{"authority":"crovia.substrate.bootstrap","rfc3161_token":"{\"kind\":\"crovia.bootstrap.tsa\",\"source_jsonl\":\"/opt/crovia/spider/data/news/vendor_press_v1.jsonl\",\"source_seal_merkle_root\":\"spider_vendor_press_v1\",\"upgrade_path\":\"Sessione H \\u2014 OpenTimestamps weekly anchor\"}"},"zk_mode":"clear","zk_proof":null},"ledger":{"leaf_hash":"a5ff7bab59f58f52f00a4d78762d8300175b4f37074a4803a59317624199ffb0","leaf_index":155912,"ledger_path":"/opt/crovia/substrate/axiom_ledger.jsonl"},"merkle_proof":{"hash_alg":"sha256","leaf_prefix":"0x00","node_prefix":"0x01","odd_leaf_rule":"duplicate_last","path":[{"sibling":"35bdc24bbe20e481e89598cf2a677e2ddb66a6bea798c6fbd53933537bb2743e","side":"right"},{"sibling":"c5c1bb1a459fdafd2dcc931a83abe8465eef1974e2e730cc6835511cd97b1038","side":"right"},{"sibling":"9f4eb380f2ba7d69212e9d5deb29a5aced41f999261c56bca3c94f27cd6fdd73","side":"right"},{"sibling":"a317a650249d2aec75c5271ce242d1a57c425cbc6660333468624f7bff0e99bc","side":"left"},{"sibling":"770b57953773cf60577b8207d5b83692d5c1d8731e09f84d8b52f14f709ea432","side":"right"},{"sibling":"89e66f564fa76141ff5a9278c6abe5ae020e093343ef95af222aea7ad4aeff00","side":"right"},{"sibling":"6ca55e77be0491ef320b9c77df7aeb010f9059a95b2e0a2f0b2b6582f1a052b3","side":"right"},{"sibling":"23dd40eb30de320ad1061f73adc18c4482f490a6bd28a6d2175e4ff59f041bbb","side":"right"},{"sibling":"92ebfba9adaa779ba57179e1e0f933c2128036a29e48cb81e4e64272dbbbb5c0","side":"left"},{"sibling":"f292d3278e493ec60902181b8c0bd5c89c0a1168ef928222fe6161287982f7f0","side":"right"},{"sibling":"2209295faf1a5bf51c97c6fd5a839a8181a4ea44f490420381530f35df7d9b2f","side":"right"},{"sibling":"5784576a15214ea9fc3569e6e1cff1ef443c0b1fc0d036028489088af089de27","side":"right"},{"sibling":"311772ec218efcb2da5a337f9e9f042fe1cc0028643adb0a354787e4ea7911b7","side":"right"},{"sibling":"66331bac84ca0f8983eb09fac7eaf95af234f1b82680b793eabff4ee25caac40","side":"left"},{"sibling":"35ca36cee447f0ef7064a25d55f59357c66901e31427729c4c1d8b14aa8adb6c","side":"left"},{"sibling":"7b6f0bea4291a5e63574dfca9aa0f9756f450c9478c3d07474d39a7ababb51f9","side":"right"},{"sibling":"1d39fe14b21e2ebbfb87e882423b24ee9469eae1e4c77af5b799ac4db9537467","side":"right"},{"sibling":"d841ad93efda0869e5eb97678f348f03f5caab4353e05ff4bf18f47fb945b822","side":"left"}]},"schema":"crovia.axiom_proof.v1","seal":{"first_collector_run_id":"","first_receipt_hash":"","jsonl_path":"/opt/crovia/substrate/axiom_ledger.jsonl","key_id":"430895f101d38164","last_collector_run_id":"","last_receipt_hash":"","leaf_count":156177,"merkle_root":"c5705a0243d16afd8b1ebfd731b7aa304079c442c2a7906493c5bbed374c69ec","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","run_id":"hourly_json_retrofit_20260528T053701Z","schema":"crovia.seal.v1","seal_family_version":"crovia-seal-family/1","seal_kind":"substrate_batch","sealed_at":"2026-05-28T05:37:36Z","sig_algorithm":"ed25519","signature":"f087e13febc8bb6a2e0812610de64cebc65be92915518d9c4b230799c3b161839b04c4eb1b02741f938f35545a76ab76555b04c782bdc2f9a44852d171d65909","signer_version":"1.1.0"},"trust_root":{"key_id":"430895f101d38164","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","signature_algorithm":"ed25519","url":"/registry/canon/TRUST_ROOT.md"},"verifier":{"spec":"/registry/canon/AXIOM_RECEIPT_v1.md","url":"/v/axm_18dabaf4fd2e9fe3bdda111684094698f19a006c86588a10276732f8552c9feb"}}