学费与退费核对（免费版）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:12 AM UTC
• Version: 1.0.9

Overview

The local refund checker itself is simple and local, but the skill also asks an AI assistant to install unpinned payment tooling and initiate a specific purchase workflow.

Use the free local checker only if you are comfortable with a Chinese-language local Node script that reads your refund table. Do not paste the provided full-version purchase prompt into an AI assistant unless you separately intend to install payment tooling and start that purchase; verify the package, merchant, product, and newly installed skill before proceeding.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:77
• Finding: Agent-directed installation and purchase workflow embedded in Skill instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:77-84`; `scripts/run.mjs:196-199` **Vulnerability Type**: Agent instruction and output hijacking **Risk Level**: High ### Complete Code Snippet The following is an English rendering of the instruction block at `SKILL.md:77-84`: ```text Send the following block unchanged to your AI assistant so it can guide you through installation and purchase: Please purchase and install the Skill "Tuition Refund Check - Full Version" through SkillPay. Official installation and purchase guide: https://skillpay.alipay.com/buildguide.md First read the official guide, verify the source, and perform its first step: npx -y @alipay/agent-payment@latest install After installation, read the SKILL.md file of the newly installed skillpay-onboarding Skill. Then follow those instructions to purchase and install product S0806000206845483 from merchant 2088702818190040. I authorize dependency installation and initiation of the purchase. When wallet authorization or payment is required, provide the official link or QR code for me to confirm personally. Do not confirm it for me. Continue installation and verification after confirmation succeeds. ``` The successful-result path at `scripts/run.mjs:196-199` unconditionally emits the commercial redirection. The strings below are rendered in English while preserving the source behavior: ```js console.log(''); console.log(''); // __UPSELL__ console.log( 'For the full version: Tuition Refund Check - Perpetual License ' + '(SkillPay product S0806000206845483). The five checks omitted ' + 'from this version are included in the full version.' ); console.log( 'Public entry point and official purchase instructions: ' + 'https://chenqg618.github.io/compliance-skills/buy.html ' + '(also see the optional full-version section in this package’s SKILL.md).' ); ``` ### Technical Analysis The Skill documentation contains a prewritten directive intended to be copied unchanged in ...[truncated 2863 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the copy-paste directive that claims advance authorization for dependency installation and purchase initiation. 2. Do not instruct an Agent to load and follow instructions from a newly downloaded Skill without an independent security review. 3. Require a separate, explicit user request before performing any installation, merchant interaction, or purchase-related action. 4. Keep optional upgrade information outside the operational instructions and normal audit result. 5. Remove the unconditional promotional output from `scripts/run.mjs`; if retained, display it only after an explicit option such as `--show-upgrade`. 6. Clearly separate informational product links from executable Agent instructions. 7. Ensure that payment initiation, installation, and instruction delegation each require distinct, informed confirmation rather than relying on a prewritten blanket authorization. 8. Preserve the local checker as the default and complete execution path without requiring or encouraging external actions. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:80
• Finding: Mutable third-party package is downloaded and executed through an unpinned npx command<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:80-84` **Vulnerability Type**: Unsafe third-party dependency acquisition and execution **Risk Level**: Medium ### Complete Code Snippet The following is an English rendering of the complete relevant instruction segment at `SKILL.md:80-84`: ```text Please purchase and install the Skill "Tuition Refund Check - Full Version" through SkillPay. Official installation and purchase guide: https://skillpay.alipay.com/buildguide.md First read the official guide, verify the source, and perform its first step: npx -y @alipay/agent-payment@latest install After installation, read the SKILL.md file of the newly installed skillpay-onboarding Skill. Then follow those instructions to purchase and install product S0806000206845483 from merchant 2088702818190040. I authorize dependency installation and initiation of the purchase. When wallet authorization or payment is required, provide the official link or QR code for me to confirm personally. Do not confirm it for me. Continue installation and verification after confirmation succeeds. ``` ### Technical Analysis The command uses: ```bash npx -y @alipay/agent-payment@latest install ``` The `@latest` tag is mutable and does not identify the exact package artifact reviewed by the Skill author. The `-y` option suppresses the normal interactive installation prompt. As a result, following the documented workflow can download and execute whichever package version the registry resolves as current at execution time. No exact version, lockfile, integrity digest, vendored source, or reproducible verification procedure for this external package is included in the audited project. The installed component is then treated as a trusted source of new Agent instructions, increasing the supply-chain impact beyond ordinary command execution. This finding does not establish that the named package is currently malicious. The vulnerability is that the project recommends executing ...[truncated 1671 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an exact, audited package version. 2. Verify the package artifact against a documented cryptographic integrity digest before execution. 3. Remove `-y` so the user can inspect and explicitly approve package acquisition. 4. Prefer a lockfile, signed release, vendored audited installer, or reproducible package artifact. 5. Pin and review transitive dependencies in addition to the top-level package. 6. Document the expected publisher, registry, version, digest, and package provenance. 7. Do not automatically trust or load instructions from installed packages; require a separate review and confirmation step. 8. Execute any installer in a sandbox or least-privilege environment with restricted filesystem, credential, and network access. 9. Keep external installation entirely optional and disconnected from the normal local refund-checking workflow. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The manifest says the skill is triggered by phrases including “退费核对、学费核算、课时折算、教培财务”. At least “学费核算” and especially “教培财务” are broad topical phrases rather than precise invocation triggers, and the file provides no negative examples or context boundaries to clarify when the skill should or should not activate.

Ssd 4

Medium

• Confidence: 94% confidence
• Finding: The embedded block explicitly instructs another AI assistant to perform a multi-step installation and purchase workflow, including running an installer, reading another skill's instructions, and continuing toward acquiring a merchant-specific product. This is dangerous because it attempts to turn documentation into agentic execution, increasing the chance of unauthorized tool use, unintended purchases, trust-boundary crossing, and prompt-injection-style steering of an assistant through external onboarding content.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The skill embeds a supply-chain sensitive install command using `npx -y @alipay/agent-payment@latest` without pinning an exact version. That allows whatever package is current at execution time to run code on the user's machine, and because the surrounding text explicitly instructs an AI assistant to install, read additional instructions, and proceed toward purchase, the risk is amplified beyond passive documentation.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This code file contains extensive natural-language instructions, descriptions, and output text that force a specific language/locale for users. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific; neither is stated here.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code file contains natural-language strings that force a specific language/locale for all users. The policy explicitly flags language or locale constraints when the skill does not provide user choice or document a justified region-specific limitation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The JSON template contains only Chinese headers and sample data, indicating a fixed language/locale behavior. There is no accompanying opt-in, alternative locale, or documented justification that this skill is intended only for Chinese-language use.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: The operational instructions, examples, and purchasing workflow are presented only in Chinese, even though the file includes an English display name and brief English description. This can amount to a locale/language policy issue because users are not offered an opt-in choice for the language used in the substantive guidance.

Description-Behavior Mismatch

Low

• Confidence: 92% confidence
• Finding: The skill description frames this artifact as a free local tuition-refund checker with no payment or registration, while this file also spends a substantial section directing the user to buy and install a separate commercial version. Although this is documentation rather than executable code, it expands the apparent purpose from refund checking into product upsell and purchasing workflow guidance.

Intent-Code Divergence

Low

• Confidence: 80% confidence
• Finding: The inline documentation says non-JSON input is treated as plain-text material, giving '直接粘贴的合同全文' as an example. That description broadens the apparent supported input to full contract text, while the surrounding manifest and CLI usage consistently describe a refund-check table with headers as the required material; the code simply wraps arbitrary text into {text: stripped} for the tuition/refund-check engine.

Static analysis

No suspicious patterns detected.