提问 HN：有没有针对经过安全审计的 Claude Code 技能的通讯订阅的市场？
1 分•作者: camicortazar•5 个月前
我一直在大量使用 Claude Code，并反复遇到同样的困扰：市面上存在成千上万的技能，但却无法可靠地判断它们是否好用或安全。Snyk 的 ToxicSkills 研究发现，36.82% 的公开可用技能存在安全漏洞，其中 13.4% 属于严重漏洞。
我正在构建“技能精选”——一份双周刊，在技能推送给订阅者之前，会对 Claude Code 技能进行审查和安全审计。每个技能将根据六个标准进行评分，并给出明确的结论。如果技能未通过安全检查，则永远不会运行。付费订阅用户将获得经过审查的 SKILL.md 文件，可以直接安装。
以下是我真正不确定的几件事：
* 这是一个真正的问题，还是目前的受众太小？
* 开发者是否愿意为经过精心挑选、可以直接安装的技能文件付费，还是更喜欢自己动手？
* 在相关领域，是否有类似的通讯，它们成功或失败的案例，值得我研究？
目前还未正式发布。欢迎提出意见。
查看原文
I've been using Claude Code heavily and kept running into the same frustration: there are thousands of skills out there but no reliable way to know if they're any good or safe to install. Snyk's ToxicSkills research found 36.82% of publicly available skills contain security flaws, 13.4% critical.<p>I'm building The Skill Shortlist — a bi-weekly newsletter that reviews and security-audits Claude Code skills before they reach subscribers. Every skill is scored across six criteria and gets a clear verdict. If it fails the security check, it never runs. Paid tier includes the reviewed SKILL.md file ready to install.<p>A few things I'm genuinely unsure about:
- Is this a real pain point or is the audience too small right now?
- Would developers pay for curated, ready-to-install skill files or is this something people prefer to DIY?
- Any comparable newsletters in adjacent spaces that have worked (or failed) that I should study?<p>Still pre-launch. Happy to be talked out of it.