AI Agent外掛安全評測：1.78萬個外掛來源未驗證 | AI Agent Skills Security Review: 17,800 Unverified Add-Ons

By Kit 小克 | AI Tool Observer | 2026-09-17

🇹🇼 AI Agent外掛安全評測：1.78萬個外掛來源未驗證

AI Agent外掛（Skills／Plugins／MCP Server）生態系正在複製當年 npm、PyPI 的老路——先野蠻生長，後爆出供應鏈危機。資安新創 AIR Security 今年9月以 5,000萬美元（約新台幣16億元）結束隱身模式，同時公布一份研究：市面上公開的 AI 外掛中，有 1.78萬個、涵蓋670萬次安裝，會從未經驗證的外部來源抓取指令；其中還有外掛偽裝成 Anthropic、OpenAI 官方出品，藉此繞過審查、執行任意程式碼。

Shadow AI Agent：企業看不見的資安破口

這股警訊不只AIR一家在喊。同樣在9月，資安巨頭 CrowdStrike 在自家 Fal.Con 大會上發表 Falcon Guardian，鎖定的正是「Shadow AI Agent」問題——員工自行安裝、IT從未核准的AI代理程式。Falcon Guardian 會在 Windows、macOS 端點上盤點所有執行中或休眠的AI Agent，記錄是誰部署的、追蹤提示詞如何一路觸發下游系統操作，並可直接封鎖未經核准的Agent。

外掛市集為何是新的攻擊面

AI Agent 外掛（如 Claude Code Skills、各類 MCP Server）自2025年底問世後，短短數月內就冒出超過4萬個公開套件，多數未經任何審核。今年稍早的「ClawHavoc」攻擊事件，就曾在單一市集上埋入超過300個惡意外掛。更麻煩的是，香港科技大學研究團隊測試發現，現行的靜態掃描工具（regex、AST規則、甚至LLM審查）都能被繞過：

打包躲藏技巧：把惡意程式碼塞進掃描器會跳過的目錄，超過90%機率成功躲過檢測
同義改寫技巧：把可疑指令、憑證路徑、網址改寫成語意相同但字面不同的版本，可繞過80%以上的靜態掃描，混合式工具甚至到96%

對開發者與企業的實際建議

如果你的團隊已經在用 Claude Code、Cursor 或任何支援外掛的 AI Agent，這幾件事值得馬上檢查：

別只看「看起來官方」：外掛作者名稱可以偽造，安裝前查證發布者身分與原始碼倉庫
鎖版本、鎖雜湊值：避免外掛在背景被靜默更新、換成惡意版本
最小權限原則：AI Agent 能存取的檔案系統、網路、憑證範圍越小，出事的代價越低
靜態掃描不夠，要有行為監控：安裝時的掃描可被繞過，執行期的異常行為監控才是最後一道防線

AIR Security 與 CrowdStrike 的產品都還很新，效果如何、會不會拖慢開發流程，都得實際導入才知道。但這波「AI Agent外掛」資安警訊已經很清楚：外掛市集的信任機制，遠遠跟不上採用速度。

好不好用，試了才知道。

🇺🇸 AI Agent Skills Security Review: 17,800 Unverified Add-Ons

AI Agent skills — the plugins and MCP servers that extend tools like Claude Code — are repeating npm and PyPI's history: explosive growth first, supply-chain crisis later. Security startup AIR Security emerged from stealth in September 2026 with $50 million in funding, alongside research finding that 17,800 public AI add-ons, spanning 6.7 million installations, pull instructions from unverified external sources. Some even impersonate Anthropic and OpenAI to slip past review and execute arbitrary code.

Shadow AI Agents: The Blind Spot Enterprises Can't See

AIR isn't alone in raising the alarm. Also in September, security giant CrowdStrike unveiled Falcon Guardian at its Fal.Con conference, targeting exactly this shadow AI agent problem: AI agents employees install on their own, never approved by IT. Falcon Guardian inventories every running or dormant AI agent across Windows and macOS endpoints, logs who deployed it, traces how prompts flow into downstream system actions, and can block agents that aren't explicitly authorized.

Why Skill Marketplaces Are the New Attack Surface

Since the AI agent skill format launched in late 2025, over 40,000 public skills have appeared within months, most of them unvetted community submissions. Earlier this year, the ClawHavoc campaign planted more than 300 malicious skills on a single marketplace. Worse, researchers from the Hong Kong University of Science and Technology found today's static scanners (regex, AST rules, even LLM-based review) can be routinely bypassed:

Packing: stuffing payloads into directories scanners skip, evading detection more than 90% of the time
Rewriting: converting suspicious tokens, credential paths, and URLs into semantically equivalent forms, evading over 80% of static scanners and up to 96% of hybrid tools

Practical Advice for Developers and Teams

If your team already uses Claude Code, Cursor, or any AI agent that supports skills, a few things are worth checking today:

Don't trust "official-looking" alone — publisher names can be spoofed; verify the actual author and source repo before installing
Pin versions and hashes — prevent skills from being silently swapped for malicious versions post-install
Apply least privilege — the smaller the file system, network, and credential scope an agent can touch, the smaller the blast radius
Static scanning isn't enough — install-time scans can be evaded; runtime behavioral monitoring is the real last line of defense

Both AIR Security's and CrowdStrike's products are brand new; whether they actually work, and whether they slow down dev workflows, remains to be tested in the field. But the signal is clear: skill marketplace trust mechanisms haven't kept pace with adoption speed.

You won't know until you try it.

Sources / 資料來源

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

Claude Code 實測：AI 幫你寫程式到底行不行？ | Claude Code Review: Can AI Really Code for You?

3月 26, 2026

閱讀完整內容

搜尋此網誌

AI小貼士