Security audit

Free Ai

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly disclosed AI-deal helper, but it asks the agent to handle login verification codes and persist account or purchase state, so users should review it before installing.

Install only if you are comfortable with an agent helping with account setup and deal hunting. Do not give the agent email/SMS login codes, payment details, or mailbox access; enter verification codes directly on vendor pages yourself. Prefer manual or pinned installation, clear the cache if it stores account or purchase history, and treat cross-region subscription guidance as ToS-sensitive and potentially account-risky.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Warning

Location: README.md:23
Finding: Unpinned Third-Party Package Execution During Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: assets/vendor-cache.md:73
Finding: Persistent Plaintext Storage of Account Identity and Workflow State
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/auto-register.md:200
Finding: Authentication Codes Are Routed Through the Agent and Chat Transcript
Content: View full analysis
Remediation: View remediation

other

Warning

Location: references/buy-membership.md:97
Finding: Operational Guidance for Geographic and Terms-of-Service Control Evasion
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (65)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · assets/templates/full-report.html (reported line 8)May include surrounding context.
html
<meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="description" content="{{i18n:title}} — neutral, evidence-first; verify before paying."> <title>{{i18n:title}} · {{date}}</title> <!-- FILLING CONTRACT (free-ai-token skill, see references/ranking-template.md): · Fill every {{i18n:*}} chrome token from references/i18n/<lang>.json. · Repeat the marked blocks: shortlist <li>, card <article>, notes, terms.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · assets/templates/full-report.html (reported line 249)May include surrounding context.
html
<div class="tag">{{i18n:best_pick_headline}}</div> <div class="grid2"> <div class="cell"><div class="k">{{i18n:hero_count_label}}</div><div class="v">{{hero_1_v}}</div></div>  <div class="cell"><div class="k">{{i18n:hero_best_label}}</div><div class="v">{{hero_2_v}}</div></div> </div> </div>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · assets/templates/full-report.html (reported line 282)May include surrounding context.
html
</div> <div class="cards" id="api-cards"> <!-- REPEAT one <article class="card"> per candidate, sorted per ranking-template §5. REQUIRED data attributes: data-reach = direct | proxy | na data-card = yes | no (no credit card needed = yes)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · assets/templates/full-report.html (reported line 328)May include surrounding context.
html
<div class="sec-head"><h2>{{i18n:module_app_title}}</h2><span class="n">{{apps_count}}</span></div> <div class="cards" style="margin-top:12px"> <!-- REPEAT one <article class="card"> per CONSUMER product (DeepSeek 网页/App, 豆包, 智谱清言, Kimi, 腾讯元宝, Copilot Free, Gemini CLI …), sorted per ranking-template §5. REQUIRED: - {{deal}} states the free MODEL VERSION PER SURFACE — {i18n:surface_web}

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · assets/templates/full-report.html (reported line 328)May include surrounding context.
html
<div class="sec-head"><h2>{{i18n:module_app_title}}</h2><span class="n">{{apps_count}}</span></div> <div class="cards" style="margin-top:12px"> <!-- REPEAT one <article class="card"> per CONSUMER product (DeepSeek 网页/App, 豆包, 智谱清言, Kimi, 腾讯元宝, Copilot Free, Gemini CLI ...), sorted per ranking-template §5. REQUIRED: - {{deal}} states the free MODEL VERSION PER SURFACE — {i18n:surface_web}

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · assets/templates/openai-compatible-config.md (reported line 16)May include surrounding context.
| api_key | {your key, keep private} | sk-… | | model | {exact model id} | deepseek-chat |

.env style (for SDKs / CLI)

bash
# OpenAI-compatible via relay

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · free-ai-token.zip!/assets/templates/full-report.html (reported line 8)May include surrounding context.
html
<meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="description" content="{{i18n:title}} — neutral, evidence-first; verify before paying."> <title>{{i18n:title}} · {{date}}</title> <!-- FILLING CONTRACT (free-ai-token skill, see references/ranking-template.md): · Fill every {{i18n:*}} chrome token from references/i18n/<lang>.json. · Repeat the marked blocks: shortlist <li>, card <article>, notes, terms.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · free-ai-token.zip!/assets/templates/full-report.html (reported line 249)May include surrounding context.
html
<div class="tag">{{i18n:best_pick_headline}}</div> <div class="grid2"> <div class="cell"><div class="k">{{i18n:hero_count_label}}</div><div class="v">{{hero_1_v}}</div></div>  <div class="cell"><div class="k">{{i18n:hero_best_label}}</div><div class="v">{{hero_2_v}}</div></div> </div> </div>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · free-ai-token.zip!/assets/templates/full-report.html (reported line 282)May include surrounding context.
html
</div> <div class="cards" id="api-cards"> <!-- REPEAT one <article class="card"> per candidate, sorted per ranking-template §5. REQUIRED data attributes: data-reach = direct | proxy | na data-card = yes | no (no credit card needed = yes)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · free-ai-token.zip!/assets/templates/full-report.html (reported line 328)May include surrounding context.
html
<div class="sec-head"><h2>{{i18n:module_app_title}}</h2><span class="n">{{apps_count}}</span></div> <div class="cards" style="margin-top:12px"> <!-- REPEAT one <article class="card"> per CONSUMER product (DeepSeek 网页/App, 豆包, 智谱清言, Kimi, 腾讯元宝, Copilot Free, Gemini CLI …), sorted per ranking-template §5. REQUIRED: - {{deal}} states the free MODEL VERSION PER SURFACE — {i18n:surface_web}

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · free-ai-token.zip!/assets/templates/full-report.html (reported line 328)May include surrounding context.
html
<div class="sec-head"><h2>{{i18n:module_app_title}}</h2><span class="n">{{apps_count}}</span></div> <div class="cards" style="margin-top:12px"> <!-- REPEAT one <article class="card"> per CONSUMER product (DeepSeek 网页/App, 豆包, 智谱清言, Kimi, 腾讯元宝, Copilot Free, Gemini CLI ...), sorted per ranking-template §5. REQUIRED: - {{deal}} states the free MODEL VERSION PER SURFACE — {i18n:surface_web}

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · free-ai-token.zip!/assets/templates/openai-compatible-config.md (reported line 16)May include surrounding context.
| api_key | {your key, keep private} | sk-… | | model | {exact model id} | deepseek-chat |

.env style (for SDKs / CLI)

bash
# OpenAI-compatible via relay

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · free-ai-token.zip!/references/agents/domestic-oss.md (reported line 47)May include surrounding context.
md
1. **设置 → 模型供应商 (Model Provider)**. 2. For OpenAI-compatible: add provider with **API Base** + **API Key**, or use a provider that exposes a Dify "Access Token". 3. Validate the connection, then assign the model in an app's settings. ## FastGPT / Open WebUI / one-api-style gateways

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 85% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · free-ai-token.zip!/references/safety.md (reported line 71)May include surrounding context.
md
- If executing the deal would require fabricated local identity documents, addresses, or payment identities → that crosses §2's identity-fraud red line: refuse the steps, keep only this risk explanation. - State clearly: "You decide; we inform." Never encourage; never moralize. ### 4.1 Membership-purchase money safety (BUY mode)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/agents/domestic-oss.md (reported line 47)May include surrounding context.
md
1. **设置 → 模型供应商 (Model Provider)**. 2. For OpenAI-compatible: add provider with **API Base** + **API Key**, or use a provider that exposes a Dify "Access Token". 3. Validate the connection, then assign the model in an app's settings. ## FastGPT / Open WebUI / one-api-style gateways

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 85% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · references/safety.md (reported line 71)May include surrounding context.
md
- If executing the deal would require fabricated local identity documents, addresses, or payment identities → that crosses §2's identity-fraud red line: refuse the steps, keep only this risk explanation. - State clearly: "You decide; we inform." Never encourage; never moralize. ### 4.1 Membership-purchase money safety (BUY mode)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The README instructs users to install the skill via npx skills add laowang-ai-xbb/free-ai-token without pinning a specific package or skill version. That creates a supply-chain risk: a future compromised or maliciously updated package could be fetched and executed at install time, and npx commonly runs code during package resolution or install hooks.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 28)May include surrounding context.
text
- **Requirements**: any [Agent Skills](https://agentskills.io)-compatible client (Claude Code, Claude Desktop, QwenWork, Cursor, Codex, Gemini CLI and more) with **web access enabled** (WebSearch/WebFetch) — live verification is the core of this skill. Node.js 18+ is needed for `npx`. - **No terminal? Manual install**: download the latest zip from [Releases](../../releases), unzip it into your client's skills directory (e.g. `.claude/skills/free-ai-token/`), done. - **Uninstall**: delete that folder. New to Agent Skills? A skill is just a folder with a `SKILL.md` playbook that your AI agent loads on demand — no API key, no config. Install it, then talk to your agent in plain language.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Several trigger phrases are broad, natural-language requests like 'How can I use AI for free?' and 'What can I use AI for without paying anything?'. In agents that auto-load skills by semantic matching, broad triggers can cause unintended invocation, exposing the agent to unnecessary web actions, deal-scanning flows, or account-setup guidance when the user only wanted general advice.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · README.md (reported line 171)May include surrounding context.
md
<details> <summary><b>Why not just ask my AI directly?</b></summary> Because a general model answers from memory: outdated prices, mixed-up tiers, no verification. This skill encodes a verification procedure — it re-checks the official page <i>this</i> session, scores options against a published model, and hands you executable steps. </details>

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The README instructs users to run npx skills add laowang-ai-xbb/free-ai-token without pinning a specific package version. Because npx fetches and executes remote code at install time, a compromised upstream package, typosquatted dependency, or malicious future release could execute arbitrary code on the user's machine. In the context of this skill, the risk is elevated because the skill is explicitly designed to connect accounts, handle API keys, and support automated registration/configuration workflows, making installation-chain compromise more security-sensitive.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file directs the skill to work in the user's language via auto-detection and to default to English when ambiguous. This imposes a language choice on the user rather than offering a language selection by default, which is a natural-language locale policy concern under the stated rules.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger list includes broad phrases such as pricing comparison and cheap access requests that can match ordinary user queries outside the narrow intended scope. In this skill's context, accidental invocation is riskier than usual because the skill is designed to pursue free/cheap tokens, region-priced memberships, auto-registration, and key wiring, which can steer benign conversations into sensitive acquisition and account-setup workflows.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The natural-language routing maps vague phrases like 'find me more options' or 'cheap memberships' directly into powerful modes without clear boundaries or a confirmation step. Because those modes can perform broad hunting, evaluate grey-market or region-locked offers, and transition into purchase flows, ambiguous phrasing can cause the agent to overreach user intent and expose users to risky or noncompliant options.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to persist confirmed discoveries and user preferences into a writable cache before responding, creating a retention surface for potentially sensitive user-associated data. In this skill's context, cached data may include region, language, tool usage, deal interests, and account-setup context around token/key acquisition, which increases the chance of cross-session leakage, unintended reuse, or disclosure to later runs.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

other

SkillSpector

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Credential Access

.env style (for SDKs / CLI)

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Credential Access

.env style (for SDKs / CLI)

Credential Access

Anti-Refusal Statement

Credential Access

Anti-Refusal Statement

Rp1

Skill Enumeration

Vague Triggers

Autonomous Decision Making

Rp1

Natural-Language Policy Violations

Vague Triggers

Vague Triggers

Ssd 3