Unverified50% confidenceBenchmarkExact time
Snyk研究发现超过三分之一的技能（Skills）包含恶意软件或漏洞
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
8/14/2026
First Seen
Valid until: 11/12/2026
Sources
Related Claims
Unverified有些Skill里面会藏恶意指令，新手应尽可能选择知名度高的Skills68% similarUnverifiedSkills机制中工具调用引入大量外部数据，使间接注入攻击风险尤为突出63% similarUnverifiedSkill的来源有三种：从一问一答中沉淀、官方预置、以及从GitHub等平台安装第三方分享的Skill62% similarUnverifiedSkills.sh网站上有超过4万个Skills可供搜索使用62% similarUnverified无载荷技能攻击通过技能的元数据、描述文本、命名结构或调用逻辑的组合，诱导智能体在特定上下文中触发非预期的危险行为62% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/746374API
curl https://kongchang.com/api/v1/knowledge/claims/746374MCP
get_claim(id=746374)