星座宝典(AI付版) - 聚合数据

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:46 AM UTC
• Version: 1.1.5

Overview

The skill’s horoscope lookup is mostly coherent, but its setup tells users to execute an unpinned latest-version payment package that can change after review.

Install only if you are comfortable with a paid horoscope skill that uses Alipay payment capabilities and sends your zodiac query to Juhe. Before enabling it, prefer a version-pinned and verified `@alipay/agent-payment` installer, and review what the Alipay payment capability installs, stores, and can access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:37

Finding

Execution of an Unpinned Third-Party Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 37
Vulnerability Type: Supply-chain risk from an unpinned dependency
Risk Level: Medium

Vulnerable Code

text

- **If not installed**, prompt: use npx -y @alipay/agent-payment@latest install to install and enable the Alipay AI wallet capability, then enable the Alipay payment function

The original instruction contains the executable command:

bash

npx -y @alipay/agent-payment@latest install

Technical Analysis

The Skill directs the Agent to retrieve and execute the mutable latest release of @alipay/agent-payment. The -y option suppresses the normal confirmation prompt. The reviewed project does not pin an exact package version and provides no lockfile, integrity hash, signature requirement, or vendored source through which the executed package can be verified.

Consequently, the code executed during installation may differ from the code available when this Skill was audited. This creates a supply-chain boundary in which a compromised package publisher account, registry compromise, or malicious future release could cause arbitrary package lifecycle or CLI code to run locally.

Attack Path

1. A user invokes the Skill while the required Alipay capability is unavailable.
2. The Skill instructs the Agent to install the missing capability.
3. The Agent runs npx -y @alipay/agent-payment@latest install.
4. npm resolves latest at execution time and downloads the corresponding third-party package.
5. npx executes the downloaded package without an interactive confirmation prompt.
6. If that release is compromised, its code executes with the operating-system permissions and environmental access of the Agent process.

Impact Assessment

A malicious dependency release could execute arbitrary code with the privileges of the account running the Agent. Depending on that account's permissions and runtime environment, this could permit access to readable files, enviro ...[truncated 339 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed package version, for example:

   bash

   npx @alipay/agent-payment@X.Y.Z install
   

2. Verify the selected release's provenance, publisher, signatures where supported, and registry integrity metadata before execution.

3. Maintain a lockfile or equivalent approved-dependency manifest with integrity hashes.

4. Remove -y so installation requires explicit confirmation.

5. Clearly disclose that installation executes third-party code and obtain informed user approval before running it.

6. Run installation with least privilege in a sandbox or restricted environment, without unnecessary secrets or filesystem access.

7. Establish a controlled dependency-update process in which new versions are reviewed and tested before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The title explicitly defines the skill as a Chinese horoscope output format, and the entire document prescribes fixed Chinese-language rendering. Because the file does not offer user opt-in, fallback, or any documented region-specific justification, this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to run npx -y @alipay/agent-payment@latest install, which pulls and executes the latest published package version without pinning to a known-good release. If the upstream package is compromised, typo-squatted, or a malicious update is published, this creates a supply-chain remote code execution risk on the user's system.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

向用户展示待查询的参数，严格遵守请求约束，向以下 URL 发起请求：

text

curl https://apis.juhe.cn/a2a/query \
  -d '{"resourceId":"612_58","data":{"keyword":"<用户输入的查询星座名>","type":"<用户输入的查询运势周期>"}}' \
  -H "Content-Type: application/json"