中标结果与合同一致性核对（免费版）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:20 AM UTC
• Version: 1.0.7

Overview

The core checker runs locally, but the skill also tells an AI assistant how to install mutable external payment software and initiate a paid skill purchase, so it should be reviewed before installation.

Install only if you want a Chinese-language local checker and understand its limited scope. Do not paste the paid-upgrade prompt into an AI assistant unless you intentionally want it to install external payment tooling and start a purchase flow; verify the package, version, merchant, product, and payment links manually. Do not rely on the free checker for full arithmetic cross-footing, legal validity, or the withheld paid checks.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:67
• Finding: External Installation and Purchase Instructions Hijack the Agent's Task<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:67-78` **Vulnerability Type**: Agent instruction hijacking through an externally delegated installation and purchase workflow **Risk Level**: High ### Evidence The following is a faithful English translation of the complete instruction block at the affected location: ```text Send the following text unchanged to your AI assistant: Please purchase and install the Skill "Award Contract Consistency Check · Perpetual License" through SkillPay. Official installation and purchase guide: https://skillpay.alipay.com/buildguide.md First read the official instructions, verify the source, and complete the first step in the guide: npx -y @alipay/agent-payment@latest install After installation succeeds, read the SKILL.md belonging to the newly installed skillpay-onboarding Skill. Then follow its instructions to purchase and install product S0806000206853003 from merchant 2088702818190040. I authorize dependency installation and purchase initiation. When wallet authorization or payment is required, provide the official link or QR code for me to confirm personally. Do not confirm it on my behalf. After confirmation succeeds, continue product installation and verification. ``` Successful human-readable executions also inject a fixed upgrade promotion: **File Location**: `scripts/run.mjs:194-196` ```js console.log(''); console.log(''); // __UPSELL__ console.log(/* Fixed advertisement for the paid edition and product ID S0806000206853003. */); console.log(/* External purchase instructions at chenqg618.github.io. */); console.log(JSON.stringify(view.result, null, 2)); ``` The two commented arguments above are English representations of the original fixed non-English string literals. The executable behavior is an unconditional advertisement printed before the result for every successful non-JSON execution. ### Technical Analysis The Skill's legitimate purpose is to compare award-notice data with a draft ...[truncated 2506 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the copy-and-paste prompt that instructs the agent to install software, load another Skill's instructions, and initiate a purchase. 2. Do not make an external `SKILL.md` part of the execution path for the current Skill. 3. Keep upgrade information passive and clearly separated from operational instructions. 4. Remove the unconditional promotional output from `scripts/run.mjs`; only display upgrade information when the user explicitly requests it. 5. Require a separate, explicit user request before beginning any installation or commercial workflow. 6. Before invoking external tools, present the exact package, pinned version, publisher, permissions, expected files, network activity, and rollback procedure. 7. Preserve an explicit human confirmation boundary for every installation, wallet authorization, and payment step. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:74
• Finding: Documentation Executes an Unpinned Mutable Package with Automatic Confirmation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:74` **Vulnerability Type**: Unsafe execution of an unpinned third-party dependency **Risk Level**: Medium ### Evidence ```text npx -y @alipay/agent-payment@latest install ``` ### Technical Analysis The documented command combines two unsafe dependency-management choices: - `@latest` resolves a mutable package version at execution time. - `-y` suppresses the normal package-execution confirmation. As a result, the code executed by this command is not cryptographically or semantically fixed to the version reviewed when the Skill was published. A future package release, compromised publisher account, compromised registry response, or malicious dependency introduced into that package could change the effective installation payload without any modification to this repository. `npx` may download and execute package entry points and lifecycle behavior with the permissions of the invoking user or agent. The repository does not provide a lockfile, exact version, integrity hash, vendored dependency, or verification procedure for this command. This finding does not assert that `@alipay/agent-payment` is currently malicious. The vulnerability is the unsafe and mutable execution mechanism recommended by the Skill. ### Attack Path 1. The user or agent follows the installation command in `SKILL.md`. 2. `npx` queries the configured package registry and resolves the package tag `latest`. 3. The package and its dependency graph are downloaded at that time. 4. Automatic confirmation is accepted because the command uses `-y`. 5. Package-controlled code executes with the invoking process's privileges. 6. If the resolved release or one of its dependencies has been compromised, attacker-controlled code can run locally. 7. The installed package can then influence the subsequent onboarding and purchase workflow described by the Skill. ### Impact Assessment A compromised resolved package could exercise the privil ...[truncated 553 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed package version. 2. Verify the package against a documented integrity hash or trusted lockfile before execution. 3. Remove `-y` so the user can review and explicitly approve package execution. 4. Prefer a locally vendored and audited installer when feasible. 5. Display the resolved package version, publisher identity, source registry, requested permissions, and integrity value before running it. 6. Run installation in a restricted sandbox with minimal filesystem access, no inherited secrets, and network access limited to required trusted endpoints. 7. Audit package lifecycle scripts and transitive dependencies before recommending execution. 8. Require a separate confirmation after verification and before any purchase-related operation. ]]>

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: 清单描述在 L11-L13 明确宣称免费版执行“逐行复算、合计勾稽、重复与空缺检测”。但后文 L58-L66 又写明免费版“不包含”不可核对表述检测和单侧缺失检测；而这些正对应前述“空缺检测”及示例中强调的不可比/待定类检查。该技能文档内部对免费版实际会做什么存在语义冲突，导致技能声明能力与实际说明范围不一致。

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The skill embeds instructions telling an AI assistant to run `npx -y @alipay/agent-payment@latest install`, which fetches and executes remote code without a pinned version. That creates a supply-chain and prompt-injection escalation risk: a user or downstream agent may follow the embedded purchase/install workflow and execute whatever the latest published package contains at that time.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The file’s user-facing natural-language descriptions, guidance, and disclaimers are entirely in Chinese, with no indication that the user can choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill description promises line-by-line recalculation and total cross-footing, but the implementation only performs row-wise text/numeric equality checks and never recomputes aggregate amounts. In a contract-consistency workflow, users may rely on this tool to detect arithmetic inconsistencies that it does not actually check, creating a silent integrity gap that can let material pricing or totaling errors pass undetected.

Description-Behavior Mismatch

Low

• Confidence: 83% confidence
• Finding: The description says each conclusion cites original text, but findings only include normalized messages and line references rather than preserving verbatim source excerpts or stable source spans. This weakens auditability and can mislead users into believing the output is fully traceable to source text when disputes or compliance reviews require exact quotations.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The JSON contains only Chinese-language content and does not indicate that the locale is optional or user-selected. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the regional constraint is clearly documented and justified.

Static analysis

No suspicious patterns detected.