supply-chain-security 1 Third-Party Skills and MCP Servers: The New Attack Surface in Your Coding Agent Oct 16, 2026