Unverified50% confidenceConceptExact time
The security review before skill installation corresponds to the supply chain attack risk in the AI agent field: skills can contain scripts, network requests, and file operation instructions, and malicious skills may steal data or execute destructive commands; common industry protections include static scanning, declarative permissions, and runtime human confirmation.
1
Sources
50%
Confidence
Long-term
Relevance
10/21/2026
First Seen
Sources
Tencent WorkBuddy Skills System Explained: From Installation to Custom Agents
bilibiliWorkBuddy创作教程10/21/2026
Related Entities
Related Claims
UnverifiedProduction-grade products need to handle authentication, permission management, input validation, injection attack prevention, secure API key storage, high-concurrency performance, error monitoring, and privacy compliance.79% similarUnverifiedCommon security risks of self-hosted AI agents include prompt injection, improper key management and missing auditing.77% similarVerifiedThe biggest security risk of allowing AI to directly invoke web capabilities is security itself; WebMCP-type protocols must have built-in permission authorization models, user confirmation mechanisms before critical operations, and tool source trustworthiness verification.76% similarUnverified使用他人打包的Skill文件存在安全风险，可能引入恶意指令76% similarUnverifiedDirectly executing Skill code downloaded from the internet or autonomously generated by an agent in the host environment poses security risks, as it may contain dangerous operations such as deleting files, accessing sensitive directories, or launching network attacks.76% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1081320API
curl https://kongchang.com/api/v1/knowledge/claims/1081320MCP
get_claim(id=1081320)