面试题库

7 天 Agent Skills：把经验做成可复用能力

D4 带脚本的 skill：可执行附件、依赖与沙箱、跨平台，以及文档处理类 skill 的拆解

• skill 里带脚本会带来哪些安全风险？你会怎么限制它？另外，为什么文档处理这类任务要先规划再校验后执行？What security risks come with bundling scripts in a skill, how would you contain them, and why should document tasks follow plan, validate, then execute?

  国内高频海外高频深入#agent-skills#security#workflow-design

  分析过程 · 先想清楚再作答

  1. 这题有两半，别只答一半。前半考安全边界，后半考流程设计，两者的共同点是「在不可逆的动作之前留一道闸门」。
  2. 安全这一半按来源、权限、输入、动作四层说。来源：第三方 skill 里的脚本就是别人的代码，装之前要读 scripts 目录，跟装一个包之前看两眼是一回事——skill 更容易被当成文档而放松警惕。
  3. 权限：预批工具要卡到命令级，写「允许 git 的只读子命令」而不是「允许任意 shell」；而且这个字段还是实验性的，各家支持不一，不要把安全性全押在它上面。
  4. 输入：脚本处理的外部文件与接口返回是不可信输入。脚本不把它当代码执行就不会被直接利用，但**脚本的输出会进模型上下文**，原样回显一大段外部内容等于把那段话讲给模型听。动作：删除覆盖发布要给预演开关或确认参数，因为 Agent 会重试。
  5. 第二半给三步流程，并强调价值全在中间那步：分析脚本产出的是真值，模型不该凭记忆猜字段；校验脚本比对计划与真值，错误信息要够模型自己改对；填充脚本才落盘。
  6. 两条设计纪律要点出来：校验脚本不改数据、填充脚本不做校验，混在一起模型就没法在计划和执行之间停下来；中间产物要落盘成文件，否则校验脚本读不到，你也没法打开看。
  7. 可预期的追问是「为什么不能边填边校验」。答案是文件系统没有事务，写了一半的文档比完全没写更麻烦——它看起来是完整的。

  How to reason about it · think before answering

  1. Two halves; answer both. Security is about boundaries, the three-step flow is about process, and both come down to putting a gate before an irreversible action.
  2. Cover security in four layers. Source: a third-party skill's scripts are someone else's code, so read the scripts directory before installing, exactly as you would skim a package. Skills invite less scrutiny because they look like documentation.
  3. Permissions: pre-approve at command granularity, allowing read-only git subcommands rather than arbitrary shell, and remember the field is experimental with uneven support, so do not rely on it alone.
  4. Input: files and API responses are untrusted. A script that does not execute them is not directly exploitable, but script output enters the model's context, so echoing a large blob of external content effectively speaks it to the model. Actions: gate delete, overwrite and publish behind a dry run or explicit flag, because agents retry.
  5. For the second half, give the three steps and stress that the value is in the middle one: analysis produces ground truth, validation compares plan against it with self-correctable errors, and only the fill step writes files.
  6. Name two disciplines: validation never mutates and fill never validates, or the model loses its pause between planning and execution; and intermediate artifacts must be written to disk so the validator can read them.
  7. Expected follow-up: why not validate while filling? Filesystems have no transactions, and a half-written document is worse than none because it looks complete.

  答题要点

  • 第三方 skill 的脚本就是别人的代码，装之前要读一遍 scripts 目录。
  • 预批工具按最小权限、卡到命令级；该字段仍是实验性的，不能全押在它上面。
  • 外部输入不可信，且脚本输出会进上下文，不要原样回显大段外部内容。
  • 三步流程的价值全在中间那步校验：分析出真值、校验给可自纠的错误、执行才落盘。
  • 校验不改数据、填充不做校验、中间产物落盘；不要边填边校验，半成品文档看起来是完整的。

  Key points

  • Third-party skill scripts are someone else's code; read the scripts directory before installing.
  • Pre-approve tools at command granularity, and do not rely on an experimental field for safety.
  • External input is untrusted, and script output enters context, so never echo large external blobs verbatim.
  • The value of the three-step flow is the middle step: ground truth, self-correctable errors, then writing.
  • Validation never mutates, fill never validates, intermediates go to disk, and never validate while writing.