Unverified50% confidenceFactExact time
同一段网络扫描代码在安全研究场景中是合法工具，在攻击场景中可能是恶意载荷，使意图识别困难
1
Sources
50%
Confidence
Long-term
Relevance
7/7/2026
First Seen
Sources
Related Claims
Unverified现有文档安全扫描工具主要检查宏代码、嵌入对象和外部链接等已知威胁向量，几乎没有工具会审查空格字符的渐变色标点参数是否携带编码数据76% similarUnverifiedDirectly executing Skill code downloaded from the internet or autonomously generated by an agent in the host environment poses security risks, as it may contain dangerous operations such as deleting files, accessing sensitive directories, or launching network attacks.74% similarUnverifiedCybersecurity capability can be seen as a byproduct of strong coding ability; models that can understand complex code logic and locate bugs inherently have the potential to discover security vulnerabilities.72% similarUnverified发现恶意依赖被安装并不能证明恶意代码真的运行过，命中查询工具应被视为深入调查的理由而非入侵结论72% similarPartially VerifiedIndirect prompt injection attacks plant hidden instructions within normal business data to induce Agents into executing unauthorized operations, representing a security risk at the semantic level rather than the code level.72% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/126781API
curl https://kongchang.com/api/v1/knowledge/claims/126781MCP
get_claim(id=126781)