Bo Kaung

I work at the intersection of AI agents and application security. The question I keep returning to is simple: what can this thing do to my machine? Most of my work is about answering it with evidence instead of vibes.

That has meant building SkillTriage, a static auditor for agent skills and Claude Code plugins, and mapping the OWASP lists into an offline atlas. It has also meant writing down the sessions that produced them — including the clean scan that scanned nothing, and the rule that failed before it worked.

What I write about

• AI agent security: skills, plugins, MCP servers, hooks, and supply chain.
• Static analysis: Semgrep, SARIF, policy gates, and the limits of a clean result.
• Evidence: reproducible runs, raw output, and what a tool does not prove.

Elsewhere

• GitHub — @cicada-369
• LinkedIn — in/bokaung
• Hashnode — bokaung.hashnode.dev

Colophon

This site is built with Jekyll and hosted on GitHub Pages. No trackers, no external fonts, no client-side analytics. The design follows the system light or dark theme. The source is at github.com/cicada-369/cicada-369.github.io.