生日万象查询服务(AI付版) - 聚合数据

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:35 AM UTC
• Version: 1.0.6

Overview

This paid birthday-reading skill is mostly transparent about sending a date to Juhe and using Alipay, but its payment dependency setup uses an unpinned network installer for a high-impact payment capability.

Review this before installing because it may ask you to install and enable Alipay payment support using an unpinned `@latest` npm command. Only proceed in an isolated environment, verify the Alipay package source, confirm the exact price and order details before payment, and do not provide more personal information than the date needed for the lookup.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Execution of an Unpinned npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35–37
Vulnerability Type: Supply-chain risk through an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code Snippet

text

2. 依赖校验规则：技能启动时自动检测上述两个技能安装状态、开关状态；
   - **如检测未安装**，提示：通过 npx -y @alipay/agent-payment@latest install 帮我**安装开通支付宝AI钱包的能力**,安装后帮我**开启支付宝支付功能**
   - **未开启支付功能时**：提示用户**开启支付宝支付功能**

The actionable command in this passage is:

bash

npx -y @alipay/agent-payment@latest install

Technical Analysis

The Skill instructs the user or agent to invoke an npm package through npx using the mutable latest tag. The -y option automatically accepts the package execution prompt.

Because no exact version or package integrity value is specified, the code ultimately executed is determined by whichever release the registry resolves as latest at invocation time. That release may differ from the version available when this Skill was reviewed. This creates a time-of-review versus time-of-use gap and prevents the audited Skill from guaranteeing the behavior of the downloaded executable.

The issue does not establish that the named package is currently malicious. The vulnerability is the unsafe dependency acquisition and execution pattern, which exposes users to future package compromise, publisher-account compromise, malicious releases, or unexpected behavior introduced by an upstream update.

Attack Path

1. An attacker compromises the npm publisher account, package distribution process, or another component capable of changing the package release resolved by @latest.
2. The attacker publishes a malicious version and causes it to become the package's latest release.
3. The Skill detects that the expected payment capability is not installed and presents the documented installation instruction.
4. A user or agent runs:

   bash

   npx -y @alipay/agent-payment@latest install
   

5. npx retrieves the attacker-controlled release from the regist ...[truncated 1001 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable latest tag with an exact, reviewed package version:

   bash

   npx @alipay/agent-payment@X.Y.Z install
   

2. Remove -y so that users receive an explicit confirmation prompt before newly downloaded package code executes.

3. Verify the package's provenance, publisher identity, registry source, and integrity before execution. Where supported, enforce npm provenance attestations and approved registry configuration.

4. Lock and review transitive dependencies for the selected release. Re-audit before upgrading the pinned version.

5. Prefer installing through a controlled deployment process rather than dynamically retrieving and executing a package from the network during Skill use.

6. Execute installation with least privilege in an isolated environment. Do not expose unrelated credentials, sensitive environment variables, host files, or unrestricted network access to the installer.

7. Require explicit informed user approval before any installation or payment capability enablement occurs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

向用户展示待查询的参数，严格遵守请求约束，向以下 URL 发起请求：

text

curl https://apis.juhe.cn/a2a/query \
  -d '{"resourceId":"619","data":{"keyword":"<用户输入的查询日期>"}}' \
  -H "Content-Type: application/json"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file presents all user-facing instructions and output format exclusively in Chinese, and does not indicate that the user can choose another language or that the locale restriction is intentional. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.