Unverified60% confidenceOpinionTime unknown
Using Skill files packaged by others carries security risks and may introduce malicious instructions.
2
Sources
60%
Confidence
Long-term
Relevance
6/2/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedDirectly executing Skill code downloaded from the internet or autonomously generated by an agent in the host environment poses security risks, as it may contain dangerous operations such as deleting files, accessing sensitive directories, or launching network attacks.81% similarUnverified组合多个各自安全的技能模块可能产生意料之外的安全缺口，例如文件读取技能与网络通信技能结合可被利用实现数据外泄77% similarUnverifiedThe security review before skill installation corresponds to the supply chain attack risk in the AI agent field: skills can contain scripts, network requests, and file operation instructions, and malicious skills may steal data or execute destructive commands; common industry protections include static scanning, declarative permissions, and runtime human confirmation.76% similarUnverifiedRunning executable files from unknown sources carries extremely high risk, potentially tampering with system configurations, implanting proxies, and collecting local information.76% similarUnverifiedDifferent types of tools have different risk surfaces: the main risk of retrieval tools is privacy leakage, action tools produce irreversible side effects, compute tools carry the risk of resource exhaustion, and write tools carry the risk of data corruption or loss.76% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/37509API
curl https://kongchang.com/api/v1/knowledge/claims/37509MCP
get_claim(id=37509)