Unverified50% confidenceCautionExact time
技能可以包含并运行代码，下载陌生人的技能等同于在自己机器上运行陌生人的代码，构成安全风险
1
Sources
50%
Confidence
Long-term
Relevance
8/21/2026
First Seen
Sources
Related Claims
Unverified无载荷技能攻击通过技能的元数据、描述文本、命名结构或调用逻辑的组合，诱导智能体在特定上下文中触发非预期的危险行为71% similarUnverifiedSkills机制中工具调用引入大量外部数据，使间接注入攻击风险尤为突出69% similarUnverified有些Skill里面会藏恶意指令，新手应尽可能选择知名度高的Skills66% similarUnverifiedSkills可以限定到特定路径，只在代码库的相关部分激活66% similarUnverifiedWhat truly differentiates the three skills is automation reusability—namely, whether the judgment exercised during interaction can be written into reusable code66% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/782672API
curl https://kongchang.com/api/v1/knowledge/claims/782672MCP
get_claim(id=782672)