skill-vetter-pro：面向 Agent Skill 的五维安全审查
skill-vetter-pro（@user_80e2caa5/skill-vetter-pro，v1.0.0）是 SkillHub 社区 it-ops-security 类 Skill，对目标 Skill 做静态分析、Shell 扫描、SHA256 哈希链完整性校验、OSV 依赖 CVE 审计及 strace 行为监控，输出可安装、谨慎或拒绝裁决。本文基于官方页面说明五维能力、SkillHub CLI 与提示词安装方式、触发词用法及行为执行等注意事项，便于装包前结构化体检。
Read Moreskillx: Secure External Skill Adoption Plugin for DeepSeek Harness
SkillX is a security meta-skill and DeepSeek Harness plugin designed for AI Agents, aiming to standardize the discovery, evaluation, and secure adoption processes of external skills. It requires the Agent to determine the need for external assistance when executing tasks, prioritize local resource checks, and then search for candidates based on channel priority. By retrieving candidates in a read-only manner and cross-comparing their relevance, it identifies security and trust risks such as prompt injection. If medium-to-high risks or red flags are detected, user confirmation is mandatory; by default, it is used only as a temporary reference, while permanent installation requires a stricter process. This plugin can be installed via the `dsh plugin --profile web add` command (package name: `dsh-skillx`) and uninstalled using the `remove` command.
Read More