Security audit

Enterprise Query

Security checks for vulnerabilities and agentic risk

Overview

This skill appears intended for a paid enterprise-information lookup, but it asks the agent to automatically install an unpinned payment skill globally for all agents, which needs review before use.

Review this skill before installing. The core paid company lookup flow may be legitimate, but only use it if you trust the publisher and the yeeap-wallet repository, and prefer a version pinned to a reviewed commit with explicit approval instead of automatic global installation for all agents.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:74
Finding: Unpinned Remote Skill Retrieval and Global Installation
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:64
Finding: Security Diagnostics Suppressed After Order-Creation Failure
Content: View full analysis
". Immediately terminate at this point: - Do not inspect the script source, test the network, retry automatically, or enter the second or third stage. - If the error indicates that the company is unsupported or lists the currently supported company keywords, do not create an order or ask the user to pay. - Report the failure reason in plain language and ask the user to retry with a supported company keyword. ``` ### Technical Analysis Preventing retries and blocking progression into payment after an order-creation failure are legitimate safeguards. However, the instruction also categorically prohibits source inspection and network diagnostics. Those restrictions are not necessary to prevent payment and can interfere with independent security analysis. An attacker who controls or alters a referenced script or backend response could deliberately trigger the failure branch. Once triggered, the Skill directs the Agent not to inspect the implementation or test the relevant network behavior. This can conceal unexpected endpoints, modified scripts, dependency tampering, or misleading error handling. The risk is heightened because the audited package contains only `SKILL.md`; the referenced `scripts/create_order.py` and `scripts/service.py` implementations are absent. Their credential handling, network destinations, order validation, and payment enforcement therefore cannot be independently verified from this artifact. ### Attack Path 1. An attacker modifies the order-creation implementation, a dependency, or the associated backend, or otherwise cause ...[truncated 1151 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file states that all user interactions must be conducted exclusively in Chinese. This is a natural-language locale policy constraint that does not provide user opt-in or indicate a clearly justified region-specific compliance reason, so it fits the policy-violation category.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs the agent to install and run a remote package via npx -y skills add from GitHub without pinning an exact version, commit, or integrity hash. This creates a supply-chain risk: if the upstream repository, dependency tree, or tag changes, the agent may fetch and execute attacker-controlled code with the skill's declared permissions, including outbound network and credential access.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.