Security audit

健身训练计划

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches a fitness-plan helper, but it adds a paid remote API and an unpinned executable payment installer that are not clearly scoped in the manifest.

Review this skill carefully before installing. Its fitness advice content is straightforward, but using the paid integration means sending requests to an external service and running a payment installer from npm. Prefer a pinned, reviewed installer version and clear disclosure of payment/API behavior in the manifest before trusting it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: displayName 与全文说明均固定为中文，且未说明支持其他语言或允许用户自行选择输出语言。按组织语言/locale 政策标准，若技能默认强制单一语言而没有用户 opt-in，可能构成自然语言层面的策略违规。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: 该清单中的“增肌”“减脂”“每周练几天”都是常见健身话题表达，不足以唯一指向此技能；描述也未提供排除条件或负例来界定何时不应触发。对于 manifest/markdown 作用域下的触发定义，这种宽泛短语容易与普通对话重叠。
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest frames the skill as a fitness-plan generator, but the file additionally introduces a paid remote API and payment workflow. This expands the trust boundary beyond simple content generation and can mislead users or downstream agents into invoking external payment/install behavior they did not expect from the declared skill purpose.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Embedding payment/install capability inside a fitness-planning skill is context-inappropriate and increases the chance that an agent or user follows unrelated high-risk actions. In this context, external payment and tool installation are not necessary to safely describe workouts, so their presence is suspicious and increases the attack surface.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs users to execute npx -y @alipay/agent-payment@latest install, which fetches and runs the latest package version without pinning. This creates a supply-chain risk: if the package is compromised or a breaking/malicious release is published, users may execute attacker-controlled code during installation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.