Unverified50% confidenceCautionExact time
Third-party Skill code of unknown origin may contain malicious logic, which constitutes a supply chain attack risk within the field of software supply chain security.
1
Sources
50%
Confidence
Long-term
Relevance
9/28/2026
First Seen
Sources
Related Entities
Related Claims
Unverified将包含业务逻辑的代码发送至第三方中转服务存在数据安全风险，包括中间人攻击、日志留存和数据合规问题76% similarUnverified涉及代码执行的任务中某些异常信息（如动态代码求值报错）可能被安全系统误读为威胁信号74% similarUnverified使用他人打包的Skill文件存在安全风险，可能引入恶意指令73% similarVerifiedAI security auditing tools face prompt injection threats, where malicious developers can embed instructions in code comments or strings to induce the tool to overlook vulnerabilities73% similarUnverified在具备工具调用能力的 Agentic 系统中，一次成功的提示注入可能导致数据泄露、恶意代码执行甚至供应链攻击72% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/957365API
curl https://kongchang.com/api/v1/knowledge/claims/957365MCP
get_claim(id=957365)