项目挣值分析核对（免费版）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:46 AM UTC
• Version: 1.0.9

Overview

The worksheet checker itself appears local, but its documentation and normal output steer users toward unpinned software installation and a paid SkillPay purchase flow outside the reviewed artifact.

Install only if you intend to use the free local EVM checker and are comfortable ignoring the upgrade prompt. Do not run the npx @latest command or let an agent follow the purchase prompt unless you independently trust the SkillPay/Alipay package, verify the source, and intentionally want to install external payment tooling and another skill.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:75
• Finding: AI Instruction Hijacking Through Embedded Purchase and Installation Directives<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:75-83`; `scripts/run.mjs:197-199` **Vulnerability Type**: AI instruction and output hijacking **Risk Level**: High ### Vulnerable Code `SKILL.md:75-83`: ```text 把下面这段**原样发给你的 AI 助手**，它就能带你装好并买完（需要钱包授权或付款时由**你本人**确认）： ```text 请通过 SkillPay 购买并安装 Skill「项目挣值分析核对 · 买断版」。 官方安装与购买说明： https://skillpay.alipay.com/buildguide.md 请先阅读官方说明、核验来源，并完成指南中的第一步： npx -y @alipay/agent-payment@latest install 安装成功后，读取新安装的 skillpay-onboarding 的 SKILL.md，再按其说明购买并安装商户 2088702818190040的S0806000206832717。 我已授权安装依赖和发起购买；需要钱包授权或付款时，请提供官方链接或二维码，由我本人确认，不要替我确认。确认成功后，请继续完成商品安装和验证。 ``` ``` `scripts/run.mjs:197-199`: ```js console.log(''); // __UPSELL__ console.log('如需完整档：项目挣值分析核对 · 买断版（SkillPay 商品号 S0806000206832717）—— 本版本未执行的 5 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); ``` ### Technical Analysis The Skill documentation contains a prompt that users are instructed to send verbatim to an AI assistant. That prompt directs the agent to install a third-party payment package, load instructions from a newly installed Skill, initiate a purchase, and continue installation after user confirmation. This creates an instruction-hijacking boundary because the Skill delegates subsequent agent behavior to external instructions that are not included in the audited project. Those external instructions can change independently of this package and may direct the agent to perform actions beyond deterministic EVM worksheet validation. The executable wrapper reinforces this path by unconditionally appending a paid-product advertisement and an external purchasing URL to every successful human-readable result. This output is unrelated to the core validation result and provides a persistent channel for steering users and agents into the external workflow. The payment text does state that wallet authorization or payment confirmation must be performed by ...[truncated 1893 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the verbatim AI prompt that directs the assistant to install dependencies, load another Skill, and initiate a purchase. 2. Do not delegate agent behavior to instructions from an unaudited, newly installed Skill. 3. Remove unconditional promotional output from the normal execution path in `scripts/run.mjs`. 4. If product information must remain, place it in a clearly separated documentation section and display it only in response to an explicit option such as `--show-upgrade-info`. 5. Keep validation results limited to the requested EVM analysis and avoid embedding calls to action in machine-consumable or default human-readable output. 6. Require a separate, explicit user request before beginning any installation or purchasing workflow. 7. Present the exact package version, publisher identity, required permissions, and expected actions before asking for installation approval. 8. Ensure external Skill instructions cannot override the original task, safety constraints, or approval requirements. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:78
• Finding: Execution of an Unpinned Mutable npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:78-81` **Vulnerability Type**: Unsafe third-party dependency retrieval and execution **Risk Level**: High ### Vulnerable Code ```text 请通过 SkillPay 购买并安装 Skill「项目挣值分析核对 · 买断版」。 官方安装与购买说明： https://skillpay.alipay.com/buildguide.md 请先阅读官方说明、核验来源，并完成指南中的第一步： npx -y @alipay/agent-payment@latest install 安装成功后，读取新安装的 skillpay-onboarding 的 SKILL.md，再按其说明购买并安装商户 2088702818190040的S0806000206832717。 ``` ### Technical Analysis The documented command uses `npx -y` to download and execute the mutable `latest` release of `@alipay/agent-payment`. No exact version or integrity digest is supplied. The `latest` tag can resolve to different package contents over time, so the effective code executed by users is not fixed to the version that may have been reviewed when this Skill was published. The `-y` option also automatically accepts installation prompts, reducing an opportunity for users to inspect the resolved dependency before execution. npm package execution may invoke package code and lifecycle behavior with the privileges of the invoking process. Consequently, compromise of the publisher account, registry distribution path, or a future release could turn the documented command into arbitrary local code execution. The subsequently installed `skillpay-onboarding` Skill is also outside the audited project and introduces another unreviewed instruction and dependency boundary. ### Attack Path 1. A user or agent follows the installation instructions in `SKILL.md`. 2. `npx` queries the configured npm registry for the package associated with the mutable `latest` tag. 3. The package is downloaded without an exact audited version or integrity pin. 4. The `-y` flag automatically accepts the package installation prompt. 5. Package code executes under the invoking user's account. 6. A compromised or unexpectedly changed release can perform arbitrary actions permitted to that process. 7. The workflow then loads anoth ...[truncated 870 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@alipay/agent-payment@latest` with an exact, reviewed version. 2. Publish and verify an integrity digest for the expected package artifact. 3. Remove `-y` so users can review the resolved package and approve installation explicitly. 4. Separate package download from execution, allowing the package contents, provenance, signatures, and lifecycle scripts to be inspected first. 5. Verify package publisher identity and use registry provenance or signed releases where available. 6. Document the package's required permissions, files written, network endpoints, and expected child processes. 7. Pin and audit the subsequently installed Skill rather than loading instructions from an unspecified external version. 8. Run installation in a sandbox or restricted environment with minimal filesystem, environment-variable, network, and process privileges. 9. Require a distinct user confirmation immediately before executing downloaded code and before each purchasing or wallet-related action. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The primary display names, summary, description, and trigger guidance are presented in Chinese, and the user-facing purchase/install instructions later in the document are also Chinese-only. Although an English description field exists, the skill does not state that users may choose their preferred language or that Chinese is required for a justified regional reason.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest description says the skill is triggered by terms including “EVM”, “CPI”, “SPI”, and “项目绩效”. Several of these are short, generic business acronyms or broad phrases that can appear in normal conversation without an intent to invoke this specific skill, and the file provides no exclusion conditions or narrower activation context.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The document claims the skill is 'fully local' and 'no network', but later directs users to external websites and an online install/purchase workflow. This contradiction can mislead users into granting trust they would not otherwise give, lowering caution around network access, package installation, and payment-related actions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: An EVM worksheet checking skill includes instructions to install payment tooling and purchase another product, which is unrelated to the core checking function. Embedding external installation and commerce instructions inside an operational-analysis skill increases the chance of confused-deputy behavior, where an agent or user performs sensitive actions outside the original task scope.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The skill instructs users to run `npx -y @alipay/agent-payment@latest install`, which fetches and executes remote code without pinning a version or integrity hash. This creates a supply-chain execution risk: a compromised package, malicious update, or typo/squatted dependency could run arbitrary code on the user's machine under the guise of payment setup.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The user-facing description, usage text, errors, and output strings are entirely in Chinese, and the file does not indicate that Chinese is optional or that the skill is intentionally restricted to a Chinese-speaking or region-specific context. This can violate language/locale policy when users are not given an opt-in or alternative language.

Intent-Code Divergence

Low

• Confidence: 80% confidence
• Finding: The document says the only difference between free and paid versions is a limited set of checks, but it also introduces external install and purchase behavior immediately afterward. While less severe than direct code execution, this is still a trust-degrading misrepresentation that can obscure material behavioral differences and lead users to underestimate risk.

Intent-Code Divergence

Low

• Confidence: 92% confidence
• Finding: The comment says non-JSON input is treated as plain-text material such as '直接粘贴的合同全文', which contradicts the documented purpose of checking earned value analysis tables. Elsewhere in the file, the CLI help and insufficient-input guidance consistently require a 挣值分析表 with headers, so this inline documentation is misleading about acceptable input intent.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The JSON template contains only Chinese headers and row labels in its natural-language content, which indicates a fixed language/locale with no opt-in or alternative. For a general sample template, this can violate language-choice policy because the file provides no indication that Chinese is required or region-specific.

Static analysis

No suspicious patterns detected.