BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: X-Ray Your Agents: Pentesting MCPs\, Skills\, and th
 e Plugin\n   Supply Chain\n   Tags: AI | DEF CON Demo Labs | Intermediate 
 | AppSec | Offense/Red\n   Team | Purple Team | DEF CON Demo Labs\n   When
 : Saturday\, Aug 8\, 11:00 - 11:45 PDT\n   Where: LVCCW Level 1 Hall 3 900
  (Demo Labs Track 4) - [1]Map\n\n   Description:\n\n   Agents now run with
  thousands of third-party plugins — MCP servers\,\n   Claude skills\, GP
 T actions\, IDE extensions\, plugin marketplaces —\n   and the prevailin
 g trust model is roughly “read the README and\n   hope.” Tool descript
 ions are executable prompts. Tool parameters are\n   executable code paths
 . Tool outputs feed straight into the next agent\n   step. Yet there is no
  npm audit for this ecosystem\, no signed\n   manifests\, and no capabilit
 y sandbox in the wild.\n\n   MCP X-Ray is an open-source security scanner 
 that ports classical\n   pentest tradecraft to the agent plugin supply cha
 in. It combines\n   static config and repo audit\, rules-based and LLM-dri
 ven semantic\n   analysis\, and active pentesting that actually invokes to
 ols with\n   adversarial inputs — emitting SARIF that drops into GitHub\
 , VS Code\,\n   and CI gates today. In this 30-minute session we will (1) 
 walk the\n   threat model that ties MCPs\, skills\, and plugin bundles tog
 ether\; (2)\n   live-demo X-Ray finding real vulnerabilities in each. Atte
 ndees walk\n   away with a CI template they can drop in on Monday\, and th
 ree\n   intentionally vulnerable plugins to keep practicing on.\n\n   Spea
 kers:Xia Hua\,Abhijeet Kumar\n\n   SpeakerBio:  Xia Hua\n\n   Xia is co-fo
 under and CEO of Traceforce which secures AI native apps\n   running on de
 vices. She previously led engineering at Clumio (acquired\n   by Commvault
 )\, delivering cloud data protection products that were 20x\n   faster and
  10x more scalable than competitors. Earlier\, she was an\n   in-memory da
 tabase architect at Oracle. Xia earned her PhD in Applied\n   Mathematics 
 from MIT.\n\n   SpeakerBio:  Abhijeet Kumar\n\n   Abhijeet Kumar is an OSC
 P-certified offensive security researcher and\n   M.Eng Cybersecurity stud
 ent at the University of Maryland. He has\n   disclosed critical vulnerabi
 lities across NASA\, SAIL critical\n   infrastructure\, Keurig Dr Pepper\,
  and U.S. government programs which\n   includes a CVSS 10.0 RCE that trig
 gered an official CERT-In incident\n   response and a full account takeove
 r chain affecting users across 20+\n   countries. He captains UMD's CTF te
 am RandomHackers\, which placed 1st\n   out of 64 universities at HTB Hack
  The Madness 2026\, and has spoken at\n   the Billington State and Local C
 ybersecurity Summit alongside the\n   Director of Adversary Emulation.\n\n
    Links:\n       GitHub - [2]https://github.com/traceforce/mcp-xray\n   '
 \n\n   1. #LVCCW_Level1_Hall3\n   2. https://github.com/traceforce/mcp-xra
 y\n\n\n
DTEND:20260808T184500Z
DTSTART:20260808T180000Z
LOCATION:Demo Labs - LVCCW Level 1 Hall 3 900 (Demo Labs Track 4)
SUMMARY:X-Ray Your Agents: Pentesting MCPs\, Skills\, and the Plugin Supply
  Chain
END:VEVENT
END:VCALENDAR