Show Me The Money · 来财

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:18 AM UTC
• Version: 2.8.0

Overview

This file is mainly a doorway to install a large external business-automation skill pack, and the install path is mutable enough that users should review it before trusting it.

Install only if you trust the publisher and have reviewed the full external suite at the exact version you will run. Prefer a pinned version or commit, use an isolated agent environment without unnecessary credentials, and require confirmation before any ads, outreach, payment, deployment, update, or skill-writing workflow runs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:26

Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26-28
Vulnerability Type: Unpinned external CLI and Skill dependency
Risk Level: Medium

bash

npx skills add iamzifei/show-me-the-money

Technical Analysis

The documented installation command uses an npm-distributed CLI through npx and installs a Skill suite from an external GitHub repository. Neither the CLI package version nor an immutable repository commit is specified.

Consequently, the effective content installed by this command may change after this project has been reviewed. The external suite is not included in the audited artifact, so its scripts, instructions, dependency chain, and runtime behavior cannot be verified from this project. This creates a supply-chain trust boundary around both the package resolved by npx and the repository content selected by the installer.

No evidence demonstrates that the current upstream package or repository is malicious. The vulnerability is the unsafe reliance on mutable, externally controlled installation sources rather than a verified malicious payload in the reviewed file.

Attack Path

1. An attacker compromises the npm package, its publisher account, the GitHub repository, or an authorized maintainer account.
2. The attacker publishes a modified CLI release or changes the repository content resolved by the unpinned installation command.
3. A user follows the instructions and runs npx skills add iamzifei/show-me-the-money.
4. The command retrieves the modified external component instead of the version originally reviewed.
5. The malicious component may install attacker-controlled Skill instructions, scripts, or dependencies.
6. Those components can execute or influence the agent when installation completes or when an installed Skill is subsequently invoked.

Impact Assessment

The potential scope is determined by the privileges of the account running the installation and by the capabilities granted to the installed S ...[truncated 478 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npx CLI to an explicitly reviewed version rather than allowing dynamic resolution of the current release.
2. Pin the external Skill repository to an immutable commit identifier. If the installer does not support immutable Git references, vendor the reviewed suite into a controlled release artifact.
3. Publish and verify cryptographic checksums or signed provenance for the CLI and Skill bundle before installation.
4. Audit the complete external suite, including scripts, transitive dependencies, installation hooks, and agent instructions.
5. Disable or avoid lifecycle scripts during installation unless they are required and have been separately reviewed.
6. Run installation and Skill execution with least privilege in an isolated environment that has no unnecessary credentials or sensitive filesystem access.
7. Add an update process that requires security review before changing either the CLI version or the pinned Skill revision.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The listed activation phrases include broad everyday requests such as "how do I start a business", "help me find a business idea", and the Chinese equivalents for starting a business or finding a profitable direction. These are generic user utterances that could match many ordinary conversations, and the file does not provide exclusion conditions or narrower scope constraints to limit unintended invocation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The document presents both free-form trigger phrases and explicit command-style entry points like /money, but it does not clearly state when the skill should activate from natural language versus only through the command entry. This ambiguity can cause inconsistent or unintended activation behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.