全库 Agent Skills 安全与许可证体检报告
对全库 178,156 条 Agent Skills 逐条扫描后的统计（快照 2026-08-16）：23.0% 至少命中一条安全规则，25.7% 没有声明许可证。数据可引用，请注明快照日期。
23.0%至少命中一条安全规则（41,037 条）
1.8%高风险（3,251 条）
25.7%未声明许可证，默认不可商用
44.5%存在几乎完全相同的副本
安全规则命中分布
| 规则 | 含义 | 数量 | 占比 |
|---|---|---|---|
| 涉及密钥 / 凭据 | SKILL.md 中出现 API Key、token 等字样，安装后可能要求你提供凭据。 | 34,152 | 19.2% |
| 提权 | 包含 sudo / 管理员权限相关操作。 | 2,138 | 1.2% |
| 执行代码 | 会在你的机器上运行脚本或命令。 | 2,132 | 1.2% |
| 数据外发 | 存在将本地数据发送到外部地址的行为。 | 1,547 | 0.9% |
| 删除文件 | 会删除或覆盖本地文件。 | 1,431 | 0.8% |
| 远程脚本直接执行 | 类似 curl | sh 的写法，下载内容会直接执行。 | 1,135 | 0.6% |
| 调用外部可执行文件 | 依赖仓库外的二进制程序。 | 870 | 0.5% |
| 修改执行权限 | 会给文件加上可执行权限。 | 840 | 0.5% |
| 高危删除命令 | 包含 rm -rf 类不可逆命令。 | 595 | 0.3% |
| 提示词注入风险 | 文本中含有试图接管模型行为的指令。 | 310 | 0.2% |
| PowerShell 动态执行 | 使用 IEX 执行动态拼接的命令。 | 46 | 0.0% |
| 混淆后执行 | 存在编码 / 混淆后再 eval 的代码。 | 27 | 0.0% |
| jailbreak | 7 | 0.0% |
许可证分布
| 结论 | 说明 | 数量 | 占比 |
|---|---|---|---|
| 宽松许可证 | 通常可商用，保留版权声明即可。 | 124,022 | 69.6% |
| 未声明许可证 | 默认保留全部权利，商用前需联系作者。 | 45,850 | 25.7% |
| 传染性许可证 | 衍生作品可能需要以相同许可证开源。 | 8,086 | 4.5% |
| 其他许可证 | 条款非标准，商用前请逐条阅读。 | 198 | 0.1% |
分类分布
| 分类 | 数量 | 占比 | |
|---|---|---|---|
| 其他 | 66,530 | 37.3% | |
| 测试与安全 | 21,486 | 12.1% | |
| 开发与编程 | 19,764 | 11.1% | |
| 数据与 AI | 17,456 | 9.8% | |
| 内容与媒体 | 12,604 | 7.1% | |
| 运维与 CI/CD | 11,283 | 6.3% | |
| 研究与分析 | 8,884 | 5.0% | |
| 商业与运营 | 7,120 | 4.0% | |
| 文档与写作 | 5,108 | 2.9% | |
| 数据库 | 3,620 | 2.0% | |
| 生活与效率 | 3,487 | 2.0% | |
| 区块链与 Web3 | 814 | 0.5% |
高风险样本
- 1
skill-creator
Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with vari…
- 2
browser-testing-with-devtools
Tests in real browsers via Chrome DevTools MCP. Use when building or debugging anything that runs in a browser. Use when you need to inspect the DOM, capture console errors, analyze network requests, profile performance, or verify visual o…
- 3
skill-creator
Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with vari…
- 4
bash-linux
Bash/Linux terminal patterns. Critical commands, piping, error handling, scripting. Use when working on macOS or Linux systems.
- 5
bash-linux
Bash/Linux terminal patterns. Critical commands, piping, error handling, scripting. Use when working on macOS or Linux systems.
- 6
bash-linux
Bash/Linux terminal patterns. Critical commands, piping, error handling, scripting. Use when working on macOS or Linux systems.
- 7
bash-linux
Bash/Linux terminal patterns. Critical commands, piping, error handling, scripting. Use when working on macOS or Linux systems.
- 8
bun-development
Fast, modern JavaScript/TypeScript development with the Bun runtime, inspired by [oven-sh/bun](https://github.com/oven-sh/bun).
- 9
bun-development
Fast, modern JavaScript/TypeScript development with the Bun runtime, inspired by [oven-sh/bun](https://github.com/oven-sh/bun).
- 10
cloud-penetration-testing
Conduct comprehensive security assessments of cloud infrastructure across Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).
- 11
cloud-penetration-testing
Conduct comprehensive security assessments of cloud infrastructure across Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).
- 12
cloud-penetration-testing
Conduct comprehensive security assessments of cloud infrastructure across Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).
- 13
cloud-penetration-testing
Conduct comprehensive security assessments of cloud infrastructure across Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).
- 14
cohesivity
Provision backend infra through Cohesivity (cohesivity.ai): Postgres, hosting, auth, storage, and AI model APIs over one HTTP API. Use when a .cohesivity file exists or a project needs a backend.
- 15
cohesivity
Provision backend infra through Cohesivity (cohesivity.ai): Postgres, hosting, auth, storage, and AI model APIs over one HTTP API. Use when a .cohesivity file exists or a project needs a backend.
- 16
cohesivity
Provision backend infra through Cohesivity (cohesivity.ai): Postgres, hosting, auth, storage, and AI model APIs over one HTTP API. Use when a .cohesivity file exists or a project needs a backend.
- 17
container-security-hardening
A production-focused guide for building, scanning, and running containers securely — from Dockerfile authoring through runtime enforcement and supply chain integrity.
- 18
container-security-hardening
A production-focused guide for building, scanning, and running containers securely — from Dockerfile authoring through runtime enforcement and supply chain integrity.
- 19
devcontainer-setup
Creates devcontainers with Claude Code, language-specific tooling (Python/Node/Rust/Go), and persistent volumes. Use when adding devcontainer support to a project, setting up isolated development environments, or configuring sandboxed Clau…
- 20
devcontainer-setup
Creates devcontainers with Claude Code, language-specific tooling (Python/Node/Rust/Go), and persistent volumes. Use when adding devcontainer support to a project, setting up isolated development environments, or configuring sandboxed Clau…