Gold Price Query

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:30 AM UTC
• Version: 0.1.0

Overview

This skill is a disclosed precious-metal price lookup guide with no hidden behavior, though its Playwright setup uses unpinned external downloads.

Install only if you are comfortable with Playwright downloading code and a Chromium browser at install time. Prefer pinning Playwright in your own project, using a lockfile, running it in a non-privileged environment, and checking the source site's rules before frequent automated queries or proxy use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:282

Finding

Unpinned Playwright Dependency and Browser Binary Download

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 282–285
Vulnerability Type: Unpinned third-party dependency and executable artifact download
Risk Level: Medium

bash

# Install Playwright
npm install playwright

# Install browser driver
npx playwright install chromium

Technical Analysis

The installation instructions retrieve Playwright without specifying an audited version, lockfile, package integrity value, or trusted registry configuration. The subsequent npx playwright install chromium command executes the installed package's CLI and downloads an additional Chromium binary.

Consequently, the code and browser artifacts executed by users can change after the Skill has been reviewed. A compromised package release, npm account, registry, dependency, or browser artifact distribution channel could introduce arbitrary code during installation. The repository contains no package.json or lockfile that would provide reproducible dependency resolution.

This is a supply-chain weakness rather than evidence that the current Playwright package is malicious.

Attack Path

1. An attacker compromises a relevant npm publisher, package release, transitive dependency, configured package registry, or browser artifact distribution channel.
2. The attacker publishes or substitutes a malicious artifact.
3. A user follows the documented npm install playwright command, which resolves the dependency without a repository-controlled version or lockfile.
4. The user runs npx playwright install chromium, executing Playwright CLI code and retrieving an additional executable artifact.
5. Malicious package lifecycle logic, CLI code, or a substituted executable runs under the installing user's account.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user performing installation. The resulting scope could include access to that user's readable files, environment variables, network c ...[truncated 404 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a package.json that pins Playwright to a specific reviewed version rather than relying on an unconstrained installation command.
2. Generate and commit a lockfile, and use npm ci for reproducible installation.
3. Configure an explicit trusted npm registry and enforce lockfile integrity checks in CI.
4. Review Playwright release notes and dependency changes before updating the pinned version.
5. Pin and verify downloaded browser artifacts where the deployment process permits it, including checksums or organization-controlled artifact mirroring.
6. Run dependency installation in an isolated, non-privileged environment without unrelated credentials or sensitive filesystem access.
7. Use dependency scanning and provenance verification controls for package and browser artifacts.
8. Replace the documented commands with reproducible setup instructions that reference the committed manifest and lockfile.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: gold-price-query
description: This skill retrieves real-time precious metal prices (gold, silver, platinum, palladium, etc.) from https://i.jzj9999.com/quoteh5. It provides bid/ask prices, daily high/low prices, and price trends for 20+ metal types.
---

# 金价查询 Skill

从 https://i.jzj9999.com/quoteh5 页面获取实时的贵金属价格信息，包括黄金、白银等贵金属的回购价格、销售价格以及高低价。

## 功能描述

- 查询实时黄金、白银等贵金属价格
- 获取贵金属的回购和销售价格对比
- 了解当日贵金属价格波动范围（高/低价）
- 投�

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The documentation instructs users to run npx playwright, which fetches and executes a package version that is not pinned. This creates a supply-chain risk: a future compromised or incompatible Playwright release could be executed in the user's environment without review.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example code hard-codes toLocaleString('zh-CN'), which enforces a specific language/locale in generated output. The policy allows locale constraints only when the user is given a choice or the restriction is clearly justified as region-specific, neither of which is stated here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.