Skill供应链扫描神器 AIAgent生态进入"Skill化"时代。ClawHub、skills.sh等平台上Skills总量已逼近75万,日均新增2.1万个。然而,Skill不只是代码,它同时承载提示词、依赖、权限和运行时行为——这让Skill成为传统供应链攻击与新型AI原生攻击的交汇点。 国家互联网应急中心(CNCERT)连续通报恶意Skills风险,英伟达发布SkillSpector扫描器发现26.1%的Skill存在安全漏洞,5.2%含有恶意意图。本文将从攻防视角拆解Skill供应链攻击链,并给出可落地的安全检测方案。

Channel
AI助力攻防演练
@AIgfzLYL
On this record: Topic · Growth · Engagement · Posts · Citations · Cite this entry
3,586subscribers
-12 since we began measuring on 15 August 2026
Risers and fallers across the register · movement among entries of 3,162–10,000.
Register entry
| Telegram ID | -1004342774193 |
|---|---|
| Type | Channel |
| Username | @AIgfzLYL |
| Created | Between 1 June 2026 and 12 August 2026 — estimated from Telegram’s id allocation, not measured. How this range is calculated. |
| First recorded | 15 August 2026 |
| Last confirmed live | 17 September 2026 |
| Measurements held | 6 |
| Confirmed unchanged | 1 time, most recently 17 September 2026 |
| On Telegram | t.me/AIgfzLYL |
Topic
Technology — a classification, not a measurement. An on-box language model (Qwen3.6-35B-A3B-FP8, prompt version 1) read this channel’s own recent posts on 14 September 2026 and assigned it the closest of 31 fixed categories, at 58% confidence. This is a model’s judgement about what the channel is likely to be about, not a fact this register measured the way a subscriber count or a view count is measured — it can be revised on a later pass, and it carries no weight anywhere else on this page. How this classification works, and why it has no browse page of its own yet.
Growth
| Measured (UTC) | Subscribers | Change |
|---|---|---|
| 17 Sept 2026, 01:39 | 3,586 | -7 |
| 13 Sept 2026, 12:38 | 3,593 | -5 |
| 4 Sept 2026, 10:57 | 3,598 | +1 |
| 25 Aug 2026, 22:17 | 3,597 | -1 |
| 15 Aug 2026, 07:45 | 3,598 | no change |
| 15 Aug 2026, 07:36 | 3,598 | first reading |
Engagement
5 posts held, back to 12 August 2026 — the reader has not yet reached the start of this channel’s public history, so older posts may sit further back, unread. Read across 1 page of Telegram’s post history, 20 posts per page.
Nothing published in the last 30 days. ERR and ER are rolling 30-day measures, so there is nothing to compute — we hold 5 posts for this entry, the most recent from 15 August 2026. An engagement rate over an empty window would be a number about nothing.
Recent posts
Trae:https://www.trae.cn/ide/download IMA:https://ima.qq.com/download 1、获取IMA API key https://ima.qq.com/agent-interface 2、Trae安装ima Skills和API key 一键复制安装命令,自动安装skill、配置api key
Telegram 中文圈搜索引擎,积木JIMU 帮你查询任何您想要的群组、频道(不论公开与私密) 👉 助力可提升搜索排名与曝光 🚀
AI赋能自动化安全测试 Trae:字节跳动 AI 原生 IDE,是能理解需求、自主调用工具完成安全测试全流程的AI 执行智能体,负责自动化跑用例、生成 PoC/Payload、复现漏洞并输出报告。 IMA:是腾讯的AI智能知识库工具,负责存储、检索知识,为 Trae 提供 测什么、怎么测、如何判定” 的知识依据。 一句话记分工:Trae 动手执行,IMA 提供知识,协同实现自动化安全测试。
Trae:https://www.trae.cn/ mcp-chrome:https://github.com/hangwin/mcp-chrome #具体的信息收集网站,本文只是举例,提供一种思路,只用fofa和bing演示 fofa:https://fofa.info/ bing:https://cn.bing.com/
Showing the 5 most recent of 5 posts we hold for @AIgfzLYL. View and reaction counts are the latest single reading for each post, not a live figure, and a recent post is still accumulating both. A view count marked ≈ was rounded by Telegram before we ever saw it — t.me prints views in full below 1,000 and to three significant figures above, so ≈1,200,000 means somewhere between 1,150,000 and 1,249,999. Unmarked counts are exact. Text is reproduced from the public post preview and truncated for length.
Mentions
Named by 1 registered channel — every channel on the register whose own posts have named this one, by its current username or any other username it currently holds, merged from two separately captured readings of the same fact so a namer caught by only one of them is not missed and a namer both caught is not counted twice. A username this channel has since dropped is not matched — that handle may belong to someone else now, and crediting today’s namer to yesterday’s owner would misattribute it.
Named by
Channels on the register whose posts name this channel's handle.
Names
Channels on the register whose handles appear in this channel's posts.
A mention is a weaker signal than a forward and is counted separately for that reason — naming a channel is not republishing it, and a handle in a post body is easy to place deliberately. The post counts beside each row below are distinct posts in which the handle appeared, from posts we have read on both sides — the “Named by N registered channels” figure above is a different count, of distinct NAMING CHANNELS rather than posts, and is not the sum of the rows under it.
Cite this entry
A live page changes as we take new readings, so a citation should name the measurement it is based on, not just the URL. The line below cites the subscriber count as measured 17 September 2026 — this entry's latest reading, not the date you are reading this.
“AI助力攻防演练” (@AIgfzLYL), 3,586 subscribers as measured 17 September 2026. Telegram Register, tgregister.com/channel/AIgfzLYL.
Full measurement history, CC BY 4.0. Every reading this register holds for this entry, not just the latest one, as a dated, downloadable record: CSV · JSON. Free to use with attribution to tgregister.com. Each file carries its own generation timestamp, which is the figure to cite for exactly when the data was retrieved.