📄 中文摘要
随着 AI 工具的快速发展，MCP 服务器、代理技能、Claude 插件和 GPT 操作等数千个软件包应运而生，承诺为 AI 代理提供强大功能。然而，当前缺乏针对这些代理软件包的安全审计机制，包括没有 CVE 数据库、没有类似 npm audit 的工具、没有安全评审、没有信任评分和共识机制。这些问题使得 AI 代理的安全性面临隐患，用户在使用这些工具时需谨慎，确保了解其运行的代码和潜在风险。
为什么您的 AI 代理需要安全审计（以及如何在 30 秒内完成）
📄 English Summary
Why Your AI Agent Needs a Security Audit (And How to Do It in 30 Seconds)
The rapid development of AI tools has led to the emergence of thousands of packages such as MCP servers, agent skills, Claude plugins, and GPT actions, promising to empower AI agents. However, there is currently a lack of security audit mechanisms for these agent packages, including the absence of a CVE database, no equivalent to npm audit, no security reviews, no trust scoring, and no consensus mechanisms. These issues pose significant security risks for AI agents, necessitating users to be cautious and aware of the code their agents are running and the potential vulnerabilities involved.