Security audit

UnionPay

Security checks for vulnerabilities and agentic risk

Overview

The skill is only a Markdown guide, but it quietly broadens a UnionPay payments skill into personal investment, statement, tax, and portfolio guidance without clear boundaries.

Review this skill carefully before installing. It is not just a payment or card-offer guide; it includes personal finance, investment, statements, tax details, and portfolio-allocation topics. Only use it if you intend to give the agent that broader financial context, and avoid sharing account statements, tax records, holdings, or bill data unless you explicitly trust the workflow and data handling.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill body describes '云闪付' investment, asset analysis, statements, tax details, and market-synced portfolio guidance, which materially exceeds and conflicts with the declared scope of UnionPay payment/transfer/card-offer guidance. This kind of scope mismatch can cause the agent to invoke the skill for sensitive financial-management requests the user did not intend, increasing the risk of mishandling high-sensitivity financial data or giving inappropriate financial guidance under a payment-oriented label.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The example triggers are highly generic, such as asking how to use the product for a 'specific scenario task' or asking about 'core features,' which can match many unrelated user intents. In combination with the broadened financial content elsewhere in the skill, these phrases increase the chance of over-triggering the skill for general finance or payment queries and routing users into an over-privileged or misleading capability set.

Natural-Language Policy Violations

Low

Confidence: 87% confidence
Finding: All user-facing description and examples are written in Chinese, and the file does not mention whether other languages are supported or whether Chinese output is required by user choice. This can be a language/locale policy issue when a skill appears to force a specific language without explicit opt-in or justification.

Static analysis

No suspicious patterns detected.