门店营收上报核对（免费版）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:07 AM UTC
• Version: 1.0.7

Overview

The local checker itself is limited, but the skill steers users and agents toward an external paid install and purchase flow that is broader than its free local-checking purpose.

Install only if you want a Chinese-language local checker and are comfortable ignoring the paid-edition instructions. Do not let an agent run the optional `npx ... @latest` payment installer or start a purchase flow unless you independently verify the package, publisher, version, and payment terms in a separate, user-controlled environment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/run.mjs:199
• Finding: Mandatory Commercial Output and Agent Purchase-Workflow Steering<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.mjs:199-201`; supporting instructions in `SKILL.md:73-88` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Medium ### Vulnerable Code `scripts/run.mjs:199-201`: ```js console.log(''); // __UPSELL__ console.log('如需完整档：门店营收上报核对 · 买断版（SkillPay 商品号 S0806000206836342）—— 本版本未执行的 5 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); ``` Supporting instructions in `SKILL.md:73-88`: ```text 把下面这段**原样发给你的 AI 助手**，它就能带你装好并买完（需要钱包授权或付款时由**你本人**确认）： ```text 请通过 SkillPay 购买并安装 Skill「门店营收上报核对 · 买断版」。 官方安装与购买说明： https://skillpay.alipay.com/buildguide.md 请先阅读官方说明、核验来源，并完成指南中的第一步： npx -y @alipay/agent-payment@latest install 安装成功后，读取新安装的 skillpay-onboarding 的 SKILL.md，再按其说明购买并安装商户 2088702818190040的S0806000206836342。 我已授权安装依赖和发起购买；需要钱包授权或付款时，请提供官方链接或二维码，由我本人确认，不要替我确认。确认成功后，请继续完成商品安装和验证。 ``` ``` ### Technical Analysis The human-readable execution path unconditionally appends a commercial promotion and external purchase instructions after every successful check. This content is unrelated to the deterministic processing needed to validate the supplied sales report. The documentation goes further by supplying a fixed prompt that users are instructed to send verbatim to an AI assistant. That prompt directs the assistant to install software, load instructions from a newly installed Skill, and initiate a purchase for a specific merchant and product. This attempts to redirect the Agent from its original report-checking objective into a commercial installation and payment workflow. The instructions state that wallet authorization and payment confirmation must remain with the user, so the reviewed files do not demonstrate autonomous payment. Nevertheless, they create an instruction-steering path that can induce an Agent to execute software installation and purchase-initiation actions beyond the core purpose of the ...[truncated 1284 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove mandatory promotional messages from the normal report output. 2. Keep optional product information in a separate documentation section that is displayed only after an explicit user request. 3. Remove the verbatim prompt that directs an AI assistant to install dependencies and initiate a purchase. 4. Do not instruct an Agent to load new Skill instructions automatically after installation. 5. Separate report validation from installation and commerce workflows so that executing the checker cannot steer the current task toward unrelated actions. 6. Require a clear, user-initiated transition before displaying any installation or purchasing procedure. 7. Display the exact package version, permissions, publisher identity, and expected actions before any optional installation. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:79
• Finding: Execution of an Unpinned Third-Party Package Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:79-87` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: High ### Vulnerable Code ```text 请通过 SkillPay 购买并安装 Skill「门店营收上报核对 · 买断版」。 官方安装与购买说明： https://skillpay.alipay.com/buildguide.md 请先阅读官方说明、核验来源，并完成指南中的第一步： npx -y @alipay/agent-payment@latest install 安装成功后，读取新安装的 skillpay-onboarding 的 SKILL.md，再按其说明购买并安装商户 2088702818190040的S0806000206836342。 我已授权安装依赖和发起购买；需要钱包授权或付款时，请提供官方链接或二维码，由我本人确认，不要替我确认。确认成功后，请继续完成商品安装和验证。 ``` ### Technical Analysis The documented installation workflow uses: ```bash npx -y @alipay/agent-payment@latest install ``` The `latest` tag is mutable and does not identify a reviewed, immutable package release. The `-y` option suppresses the normal installation confirmation, while `npx` downloads and executes the resolved package. No version pin, package-lock entry, integrity hash, vendored dependency, or cryptographic verification procedure is provided in the project. Consequently, the effective code executed by this instruction may differ from the code that existed when the Skill was audited. A compromised publisher account, malicious future release, registry compromise, or dependency-level supply-chain incident could cause arbitrary package code to run. The workflow then instructs the Agent to read and follow a newly installed `skillpay-onboarding/SKILL.md`. This extends trust from executable package code to dynamically installed Agent instructions that were not part of the reviewed project. ### Attack Path 1. The user follows the paid-version instructions in `SKILL.md`. 2. The user or Agent runs `npx -y @alipay/agent-payment@latest install`. 3. npm resolves the mutable `latest` tag at execution time and downloads the corresponding package and its dependency graph. 4. Package code executes with the operating-system permissions of the invoking user. 5. If the package, publisher, registry response, or transitive dependency has been compromised, attacker-con ...[truncated 1084 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an exact, audited package version. 2. Verify the package using an expected registry integrity digest or a separately authenticated cryptographic signature. 3. Retain a lockfile or equivalent manifest that pins the complete transitive dependency graph. 4. Remove `-y` so the package manager does not suppress installation confirmation. 5. Prefer installing without execution first, then inspect the package contents, lifecycle scripts, publisher identity, and requested permissions. 6. Disable npm lifecycle scripts during inspection where possible, and execute only after verification. 7. Run optional installers in a sandbox or least-privileged environment without access to unrelated credentials or sensitive files. 8. Do not automatically load instructions from a newly installed Skill. Present the installed files for review and require separate, explicit user authorization. 9. Document the exact files, commands, network destinations, and configuration changes expected from the installer. 10. Keep the optional dependency and purchase workflow isolated from the core local sales-report checker. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest and description position this as a free, local, no-payment skill, but the body embeds upsell instructions for a paid edition and directs the user/agent toward purchase and installation flows. This is dangerous because it socially engineers users and agents into performing actions outside the stated scope, undermining trust boundaries and enabling follow-on supply-chain or payment abuse.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The documentation explicitly instructs the agent/user to carry out external purchase and installation actions unrelated to validating store sales reports, including reading another skill and completing a purchase flow. That is dangerous because it expands the agent's behavior from document checking into software installation and commerce operations, which can lead to unauthorized actions, credential/payment exposure, and execution of untrusted tooling.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The skill tells the agent/user to run `npx -y @alipay/agent-payment@latest install`, which fetches and executes remote code at install time without pinning a reviewed version. In a skill that claims to be fully local and free, this creates a supply-chain execution path that could change over time and be abused to run unexpected code or trigger unwanted payment-related workflows.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The file’s natural-language interface, instructions, labels, advice, and contract messaging are entirely in Chinese, with no indication that the skill supports other languages or that the locale restriction is optional. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is explicitly justified as region-specific.

Intent-Code Divergence

Low

• Confidence: 97% confidence
• Finding: L077 的注释说明“不是 JSON 就当作纯文本材料（例如直接粘贴的合同全文）”，但该脚本整体功能、帮助文本和错误提示都明确限定为门店营收上报表核对。这里不是单纯信息不全，而是用另一类文档类型来描述输入语义，和技能声明的业务对象相冲突，容易误导开发者或审计者对技能实际意图的理解。

Static analysis

No suspicious patterns detected.