代码所有权体检 Code Ownership Audit

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:25 AM UTC
• Version: 1.3.3

Overview

The skill appears to do a local code audit, but its paid unlock path is under-scoped and has risky payment-tool installation and certification-integrity issues.

Review this before installing: the free audit path is local, but paid certification involves a remote payment service, an external Alipay wallet CLI, and real payment actions. Do not let an agent run the unpinned npx installer or wallet commands without explicit approval, and do not rely on certified output unless the receipt verification flaw is fixed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: paygate.py:252

Finding

Unsigned Payment Receipts Can Be Embedded as Valid Certifications

Content

View full analysis

dict: """把已验证的付款认证块并入审计报告（报告本体仍是 audit.py 离线产出）。""" certified = dict(report) certified["certification"] = { "paid": True, "oracle": receipt.get("oracle"), "out_trade_no": receipt.get("out_trade_no"), "trade_no": receipt.get("trade_no"), "amount": receipt.get("amount"), "goods_name": receipt.get("goods_name"), "fulfilled_at": receipt.get("fulfilled_at"), "receipt_signature": signature_b64, "verified_offline_with": "embedded_server_pubkey", } return certified ``` ### Technical Analysis The `embed` command treats the receipt file and signature as trusted input. It never calls `verify_receipt()` before passing the data to `embed_certification()`. That function unconditionally adds `"paid": True` and `"verified_offline_with": "embedded_server_pubkey"` to the output. Consequently, neither a valid RSA signature nor evidence of payment is required to create an apparently certified report. The presence of a separate `verify` command does not establish a security boundary because users can invoke `embed` directly, and there is no st ...[truncated 2498 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:121

Finding

Mutable Third-Party Package Is Downloaded and Executed Through npx

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented primarily as an offline code-ownership audit tool, but the documented behavior also includes remote payment-oracle interaction, payment proof handling, receipt verification, and embedding payment certification into outputs. This mismatch can mislead users and agent orchestrators about the true data flows and trust assumptions, increasing the risk of unintended network access or execution of payment-related commands.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

md

> 说明：完整报告由本机 `audit.py` 离线计算，`run` 已把它落为 `full.json`。

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The README instructs users to execute npx -y @alipay/agent-payment@latest install-experience, which pulls and runs the latest package version at install time without pinning. This creates a supply-chain risk: if the package is compromised, unpublished/replaced, or a breaking update introduces unsafe behavior, users following the documented setup command may execute unreviewed code.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documents capabilities that include local file access, shell execution, and outbound network/payment flows, but it does not declare any explicit tool scope such as permissions or allowed-tools. That makes the operational trust boundary unclear and can lead an agent platform to expose broader capabilities than users expect, especially because the skill also instructs installation and payment-related command execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description, display name, summary, and all user-facing instructions are written entirely in Chinese, and the skill does not offer any language or locale choice. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The skill instructs use of npx -y @alipay/agent-payment@latest install-experience, which pulls and executes unpinned code from the package registry at runtime. A compromised upstream package, malicious update, or dependency hijack could result in arbitrary code execution on the user's machine during installation of the payment tool.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This is the same unpinned runtime package installation pattern repeated in the dependency section, again relying on @latest. Repetition increases the chance an agent will automatically execute the unsafe install path, exposing the environment to arbitrary code from future package versions or a compromised registry/dependency chain.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This Python file contains multiple user-facing strings that force Chinese output, including warnings and remediation text, despite the tool otherwise using English CLI/help text. Because the skill does not provide user opt-in or a language-selection mechanism, it violates the language/locale policy for natural-language behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The user-facing description and command description are written entirely in Chinese, with no indication that other languages are supported or that the skill is intended only for a Chinese-speaking audience. This creates a natural-language locale policy issue because the skill appears to impose a specific language without opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The declared skill purpose is code-ownership auditing, but this file also implements payment-gating and remote interaction with a payment oracle. That mismatch is security-relevant because users or reviewers may grant the skill broader trust than intended, while the extra functionality introduces network and payment-related attack surface not disclosed by the manifest description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Remote HTTP access to a payment oracle is not inherent to code ownership auditing, so introducing it materially enlarges the threat surface. Even though the code claims auditing stays local, the networking capability can expose metadata, create payment abuse opportunities, and condition users to trust an external service in a context that appears offline-first.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The CLI does more than analyze ownership: it generates preview/full artifacts, gates access to outputs behind payment, and unlocks certified reports after remote proof submission. This hidden expansion of behavior can mislead users and automated policy systems about what the skill actually does, increasing the chance that sensitive workflows permit unintended file generation and payment-related actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The code instructs users to run npx -y @alipay/agent-payment@latest install-experience, which fetches and executes a remote package at an unpinned version. This creates a supply-chain execution risk: if the package is compromised or a breaking/malicious update is published, users may execute attacker-controlled code on their machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

This is a second occurrence of the same unsafe pattern: the skill tells the operator to install and run an unpinned external package from npm. In a security-sensitive workflow involving payments, executing unversioned third-party code increases the chance of supply-chain compromise and undermines trust in the toolchain.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · test_audit.py (reported line 32)May include surrounding context.

python

def _run(*args):
    proc = subprocess.run([sys.executable, str(SCRIPT), *args],
                          capture_output=True, text=True, timeout=120)
    return proc

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · test_structural.py (reported line 32)May include surrounding context.

python

def _run(*args):
    return subprocess.run([sys.executable, str(SCRIPT), *args],
                          capture_output=True, text=True, timeout=180)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill documentation is primarily written in Chinese, including core usage and pricing sections, while only a brief English subtitle is provided. Under the policy rule, forcing or assuming a specific language without opt-in can be a natural-language policy issue when no language choice or regional justification is stated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The preview path creates parent directories and writes a markdown file to the user-supplied destination, but there is no confirmation prompt, user-facing log/print, or local comment/docstring warning at the operation itself. For code files, file writes should have some visible disclosure unless already clearly warned elsewhere in the skill description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This branch performs directory creation and writes a markdown report file, but the code does not emit a confirmation or log message and lacks local explanatory comments about the side effect. Even though --report implies output, the rule asks for some form of disclosure for file writes when none is otherwise visible.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The comment on L203 contains non-English text ('众测') as part of an explanatory note, which signals mixed-language content without offering a language or locale choice. Under the policy, language constraints or forced language usage in natural-language content can be a violation when not documented as optional or justified.

Content

No source excerpt is available for this finding.