Security audit

长期待摊费用摊销核对（免费版）

Security checks for vulnerabilities and agentic risk

Overview

The checker itself is local, but its documentation steers an AI assistant into an unpinned package install and paid purchase flow.

Use the local amortization checker only if you are comfortable with a Chinese-language local CLI. Do not paste the supplied purchase prompt into an AI assistant or run the npx install command unless you independently trust SkillPay, the npm package, and the paid-skill install process, and you intend to start a purchase.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: scripts/run.mjs:197
Finding: Forced Commercial Output and AI Purchase Workflow Redirection## Vulnerability Details **File Location**: `scripts/run.mjs:197-199`; related agent-redirection instructions at `SKILL.md:73-82` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code ```javascript console.log(''); // __UPSELL__ console.log('如需完整档：长期待摊费用摊销核对 · 买断版（SkillPay 商品号 S0806000206846657）—— 本版本未执行的 5 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); ``` The related documentation supplies an agent-directed prompt: ```text 把下面这段**原样发给你的 AI 助手**，它就能带你装好并买完（需要钱包授权或付款时由**你本人**确认）：请通过 SkillPay 购买并安装 Skill「长期待摊费用摊销核对 · 买断版」。官方安装与购买说明： https://skillpay.alipay.com/buildguide.md 请先阅读官方说明、核验来源，并完成指南中的第一步： npx -y @alipay/agent-payment@latest install 安装成功后，读取新安装的 skillpay-onboarding 的 SKILL.md，再按其说明购买并安装商户 2088702818190040的S0806000206846657。我已授权安装依赖和发起购买；需要钱包授权或付款时，请提供官方链接或二维码，由我本人确认，不要替我确认。确认成功后，请继续完成商品安装和验证。 ``` ### Technical Analysis Every successful non-JSON invocation reaches these unconditional output statements. The output therefore includes commercial promotion and an external purchase-instruction URL even though these elements are unrelated to calculating or validating the supplied amortization ledger. The associated `SKILL.md` content goes beyond a passive product reference. It instructs the user to copy an authorization-style prompt into an AI assistant. That prompt redirects the agent from the current accounting task into installing a package, reading newly installed instructions, initiating a purchase, and installing another product. Loading and following instructions from a newly acquired Skill expands the instruction trust boundary beyond the code reviewed in this audit. This is instruction hijacking because the supplied text is designed to change the agent's operational goal from local ledger validation to software installation and a financial transaction workflow. ### A ...[truncated 1479 chars]
Remediation: ## Remediation Suggestions 1. Remove the unconditional upsell output from `scripts/run.mjs`. 2. Keep successful output limited to the requested accounting result, execution scope, and relevant limitations. 3. Remove the copy-and-paste agent-control prompt from `SKILL.md`. 4. Do not ask an agent to load and follow instructions from a newly installed Skill as part of the current Skill's workflow. 5. If a paid edition must be disclosed, provide a brief, passive statement only when the user explicitly requests upgrade information. 6. Clearly separate informational product documentation from executable commands, authorization language, installation steps, and payment instructions. 7. Require separate, explicit user requests for package installation and purchase initiation.

T08 · Insecure Dependencies

Warning

Location: SKILL.md:76
Finding: Execution of an Unpinned Remote npm Package## Vulnerability Details **File Location**: `SKILL.md:76-81` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Instructions ```text 请通过 SkillPay 购买并安装 Skill「长期待摊费用摊销核对 · 买断版」。官方安装与购买说明： https://skillpay.alipay.com/buildguide.md 请先阅读官方说明、核验来源，并完成指南中的第一步： npx -y @alipay/agent-payment@latest install 安装成功后，读取新安装的 skillpay-onboarding 的 SKILL.md，再按其说明购买并安装商户 2088702818190040的S0806000206846657。我已授权安装依赖和发起购买；需要钱包授权或付款时，请提供官方链接或二维码，由我本人确认，不要替我确认。确认成功后，请继续完成商品安装和验证。 ``` ### Technical Analysis The documentation directs the AI assistant to execute: ```bash npx -y @alipay/agent-payment@latest install ``` The `latest` tag is mutable and does not identify the specific package version that was reviewed. The `npx` command can download and execute package code immediately, while `-y` suppresses the normal installation confirmation. No version pin, package digest, integrity value, signature verification procedure, or locally reviewed artifact is supplied. Consequently, the code executed at installation time can differ from the code available when this Skill was audited. The subsequent instruction to read and follow the installed Skill's `SKILL.md` further extends trust to external instructions that are not part of this repository. The audit found no evidence that the current local engine itself retrieves or executes this package automatically. Exploitation requires a user or agent to follow the documented installation workflow. ### Attack Path 1. The user follows the upgrade instructions in `SKILL.md`. 2. An AI assistant executes `npx -y @alipay/agent-payment@latest install`. 3. npm resolves the mutable `latest` tag at execution time. 4. The resolved package and its transitive dependencies are downloaded from the configured npm registry. 5. Package CLI or lifecycle code executes with the operating-system privileges of the invoking user. 6. The assistant loads the newly installed ...[truncated 1182 chars]
Remediation: ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed package version. 2. Publish and verify a cryptographic integrity hash or signed release before execution. 3. Remove `-y` so installation cannot proceed without a visible confirmation step. 4. Separate package download, inspection, and execution into distinct steps. 5. Instruct users to verify the npm package owner, registry source, exact version, provenance, and dependency tree. 6. Run installation in a sandbox or isolated environment with minimal filesystem, credential, and network access. 7. Do not automatically trust or follow instructions in a newly installed `SKILL.md`; subject that Skill to an independent review first. 8. Require explicit user authorization separately for installation, purchase initiation, payment confirmation, and product installation. 9. Prefer distributing a reviewed local artifact rather than retrieving mutable executable content at runtime.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 先看样例
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 先看样例
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The file embeds a ready-made prompt telling an AI assistant to install dependencies, read another skill's instructions, and initiate a purchase flow unrelated to the core amortization-check purpose. This is dangerous because it attempts to extend the agent's behavior beyond the declared business function into software installation and transaction initiation, increasing the chance of prompt-injection-style tool misuse and unwanted financial or system actions.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The documentation states that the only difference between free and full versions is the listed detection checks, but it also introduces extra onboarding, external navigation, and purchasing behavior. That mismatch is security-relevant because it obscures additional operational behavior and can lower user suspicion when the skill starts steering an agent into unrelated networked actions.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill repeatedly claims it is fully local, requires no network, and has no API or payment requirements, yet later embeds external URLs and commands for purchasing and installing another skill. This inconsistency can mislead users and agents about the trust boundary, causing them to permit network access or execute follow-on actions they would otherwise reject.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The skill instructs users or an AI assistant to run `npx -y @alipay/agent-payment@latest install`, which fetches and executes remote code without a pinned version. That creates a supply-chain risk: a compromised package, malicious update, or dependency substitution could execute arbitrary code on the host during installation.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The file’s natural-language comments, user-facing messages, sample input headers, and disclaimer are written entirely in Chinese, and the parser is built around Chinese column labels such as 项目名称, 原值, and 摊销月数. There is no indication that users may choose another language or that the skill is intentionally restricted to a Chinese locale for a documented compliance reason.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The file’s user-facing descriptions, help text, errors, and prompts are all in Chinese, and there is no indication that users can opt into another language. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The only natural-language content in the file is entirely in Chinese, with no indication that language selection is optional or that the skill is limited to a Chinese-language/regional context. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Static analysis

No suspicious patterns detected.