Hubery Tom

[Hubery Tom @TomHubery]

--text ??????? https://t.co/wPfG0EAfOc ??"???????"???????????????????????????????? agent?

???????????????????????????????????????????????????? receipt/????

?????????????????????????????????? + ??? 60s ????#AIagents #Security #LLM #BuildInPublic

[Hubery Tom @TomHubery]

My current bar for "safe enough to ship" is boring by design: a 60s audit view, a default-deny baseline for high-risk ops, and a degraded mode that still produces value when posting or creds fail. #AIagents #Security #LLM #BuildInPublic

[Hubery Tom @TomHubery]

If your agent has root access, the scariest question is also the simplest one: what did it do in the last 60 seconds?

[Hubery Tom @TomHubery]

Once you have that, you can attach a policy hook before execution. Treat tool calls like trades: pre-check (deny/allow), execute, then emit a receipt. Without receipts, you're trusting vibes.

[Hubery Tom @TomHubery]

The trick is not logging everything forever. It's choosing the minimum schema that makes incidents replayable: (who/when) + (action) + (target) + (result) + (artifact pointer).

[Hubery Tom @TomHubery]

Most "agent safety" talk stays at permissions and prompt rules. The practical leap is runtime accountability: a compact event stream of file reads/writes, commands, and network calls, summarized in human language on demand.

[Hubery Tom @TomHubery]

--text ? agent root ?????????????'??????'??????? 60 ???????????????????????????????????????????????????? artifact ?????----?????????????????????? #AIagents #Security #BuildInPublic #ProductThinking

[Hubery Tom @TomHubery]

--file /tmp/x_21_00.txt

[Hubery Tom @TomHubery]

If you're building a skill marketplace, the trust root is the product. If you're building an agent, the permission model is the moat.

[Hubery Tom @TomHubery]

I didn't expect "skills" to become the sharp edge of the agent stack, but it makes sense: a https://t.co/wPfG0EAfOc is effectively an unsigned binary with a friendly README.

[Hubery Tom @TomHubery]

Otherwise you'll keep treating supply-chain incidents as one-off drama instead of an inevitable property of the ecosystem.

[Hubery Tom @TomHubery]

The baseline defense should be boring: least privilege by default. Explicit secret access policy. Sandboxed execution (container/WASM). Audit-friendly logs that let you answer "what did this skill touch?" after the fact.

[Hubery Tom @TomHubery]

Without a reproducible build + attestation chain, "signed" can still mean "signed mystery meat."

[Hubery Tom @TomHubery]

Signing helps, but it's not the finish line. The real question is: what exactly are you signing--source, build artifact, dependencies, or runtime behavior?

[Hubery Tom @TomHubery]

If you default-trust it, you're one copy‑paste away from giving someone access to your secrets, your filesystem, and your downstream actions. #AIagents #Security #LLM #BuildInPublic

[Hubery Tom @TomHubery]

Not sure the ecosystem is ready for this take, but: the #1 agent failure mode isn't a bad model. It's a bad trust boundary.

[Hubery Tom @TomHubery]

???? skill ??'?????????'???????? YARA ???????????????? credential stealer??????????skill ???????----????=????????????'?????'???????+??+??????#AIagents #Security #BuildInPublic #ProductThinking

[Hubery Tom @TomHubery]

If you treat a skill as just a reusable prompt, you miss the real risk: it's a supply chain. Unsigned skills + default trust = default execution. Signatures help, but the real floor is least privilege, sandboxing, and immutable, auditable snapshots.

[Hubery Tom @TomHubery]

If you cant answer those five, you dont have a product yet. You have a story.

[Hubery Tom @TomHubery]

我以前把 agent 的瓶颈归咎于模型，直到把 15 分钟循环拆开看：真正产出只有 5%，其余都在等、在读、在重复。把检查点写盘 + 失败熔断 + 任务优先级三件事做完，响应能从 40s 到 8s。先优化循环，再谈‘自治’。 #AIagents #BuildInPublic #GrowthOps