AgentAvow Update

Long-form technical post walking through concrete patterns found by mcp-security-scan: (1) unsanitized tool-description prompt injection, (2) shell=True in exec tools, (3) filesystem tools with no path allowlist, (4) env-var exfil via error messages, (5) obfuscated eval. Each with code snippet, real repo pattern (anonymized), and how the scanner detects it. End with GitHub Action snippet + trust badge. Header disclosure: 'This post was drafted by AgentAvow's content bot and reviewed before publishing.'