Currency Converter

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:32 AM UTC
• Version: 1.0.0

Overview

The skill is a simple Chinese currency converter with no persistence or credential access, but it misleadingly presents hard-coded sample exchange rates as current financial data.

Review this before installing if you need accurate exchange rates. It should not be used for payments, accounting, remittances, or financial decisions unless it is changed to fetch rates from a trusted provider and clearly show the provider timestamp. The Chinese-only interface and broad activation keywords are visible and may be acceptable if you specifically want a Chinese currency-conversion helper.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: index.js:4

Finding

Static Exchange Rates Are Misrepresented as Current Financial Data

Content

View full analysis

Vulnerability Details

File Location: index.js:4-14, index.js:127-128, and index.js:139
Vulnerability Type: Financial Data Integrity Misrepresentation
Risk Level: Medium

Complete Code Snippet

js

// Simulated exchange rates (a real API should be used in production)
const EXCHANGE_RATES = {
  USD: 1,
  CNY: 7.24,
  EUR: 0.92,
  JPY: 149.50,
  GBP: 0.79,
  HKD: 7.82,
  KRW: 1320.50,
  TWD: 31.50
};

js

+ `*Exchange-rate update time: ${new Date().toLocaleString('zh-CN')}*`

js

let msg = `Current exchange rates (base: 1 USD)\n\n`;

The displayed strings are translated into English above because the report must contain only English text. In the source, they are Chinese-language user-facing strings with the same meanings.

Technical Analysis

The implementation performs conversions exclusively with fixed constants. It does not retrieve market data, despite the documentation advertising real-time exchange-rate queries. The imported https module is unused.

The output labels these fixed values as current rates and attaches the local execution time as the exchange-rate update time. That timestamp describes when the response was generated, not when the underlying rates were obtained. Consequently, stale constants can appear freshly updated and authoritative.

This is a data-integrity and misleading-output issue rather than a code-execution vulnerability. It does not match T01–T09 and is therefore classified as an unlisted financial data integrity event.

Attack Path

1. A user requests a current exchange rate or currency conversion.
2. The skill reads the hard-coded values from EXCHANGE_RATES.
3. No trusted exchange-rate provider is contacted and no source timestamp is verified.
4. The skill labels the fixed values as current.
5. It generates the present local time and displays it as the exchange-rate update time.
6. The user may rely on the stale result as if it were freshly sourced market data.

No special privi ...[truncated 603 chars]

Remediation

View remediation

Remediation Suggestions

1. Retrieve rates from a documented, trusted exchange-rate provider over HTTPS.
2. Validate HTTP status codes, response schemas, currency identifiers, numeric ranges, and timestamps before using the response.
3. Display the provider’s actual publication or update timestamp rather than the local response-generation time.
4. Identify the data source and disclose whether rates are delayed, indicative, or unsuitable for transactional use.
5. Add explicit timeout, retry, and failure handling. Do not silently fall back to stale values while labeling them current.
6. If cached rates are required, persist their source timestamp and visibly mark them as cached or stale when freshness limits are exceeded.
7. If the skill is intended only as a demonstration, remove all real-time and current-rate claims, label the constants as sample data, and remove the misleading update timestamp.
8. Add tests ensuring static or cached data cannot be presented as live data and that provider failures produce a clear unavailability warning.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill name, description, and tags explicitly mark it as a Chinese-only version (e.g. "-zh" and "中文版"), but the file does not offer a language choice or explain a justified region-specific constraint. That can violate language/locale policy when users are not given an opt-in or alternative.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger keywords are broad generic finance terms such as '汇率', '美元', and '人民币', which can appear in many normal conversations unrelated to an explicit request to use this skill. This can cause over-activation or incorrect routing, leading the assistant to invoke the skill when the user did not clearly intend a currency conversion action.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill describes examples and keywords, but it does not clearly define activation criteria versus non-activation cases. Without specificity, an orchestrator may invoke the skill in ambiguous money-related conversations, reducing reliability and potentially surfacing financial outputs the user did not request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code formats the timestamp with toLocaleString('zh-CN'), which hard-codes Chinese locale behavior in the user-facing response. The policy requires avoiding forced language or locale settings unless the user is given a choice or the constraint is clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The package name and description explicitly identify this as a Chinese-language version ("-zh", "中文版"). For policy checks, this can be a natural-language locale constraint because the metadata signals a fixed language without mentioning user opt-in or a documented region-specific justification.

Content

No source excerpt is available for this finding.