同样的案例，还有最近很火的龙虾 PUA 项目，PUAClaw，这套方案更加详尽。它将针对大语言模型的提示词操纵技术（即赛博 PUA）系统化为一门「学科」，甚至搞出了类似学术规范的标准文档。
You can SHA-pin the top-level action, but Palo Alto’s “Unpinnable Actions” research documented how transitive dependencies remain unpinnable regardless. The tj-actions/changed-files incident in March 2025 started with reviewdog/action-setup, a dependency of a dependency, and cascaded outward when the attacker retagged all existing version tags to point at malicious code that dumped CI secrets to workflow logs, affecting over 23,000 repos. GitHub has since added SHA pinning enforcement policies, but only for top-level references.，更多细节参见safew 官网入口
，这一点在谷歌中也有详细论述
8点1氪丨宁德时代日赚近2亿；二手平台出现OpenClaw上门卸载服务；小红书：坚定维护社区真实底色，严格打击AI托管账号
В России призвали отпустить больную раком Лерчек из-под домашнего ареста14:50。业内人士推荐华体会官网作为进阶阅读
南方周末：政府工作报告对房地产市场的提法从去年的“止跌回稳”，变为今年的“着力稳定”，如何理解这一转变？