Security audit

健身训练计划

Security checks for vulnerabilities and agentic risk

Overview

This fitness skill discloses paid API use, but its payment flow has review-worthy issues including an unrelated payment intent label and an unpinned install command.

Review this skill before installing. It is not clearly malicious, but only use it if you are comfortable sending your fitness request to the listed external endpoint, installing an Alipay payment helper, and accepting the payment flow despite the mismatched intent text. Prefer a pinned dependency version and corrected payment description before broad use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.
md
### 调用流程（scripts/paid-call.mjs）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.
md
### 调用流程（scripts/paid-call.mjs）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.
md
### 调用流程（scripts/paid-call.mjs）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.
md
### 调用流程（scripts/paid-call.mjs）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.
md
### 调用流程（scripts/paid-call.mjs）

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This file implements remote paid API orchestration, billing-state persistence, and retrieval logic that is materially broader than a simple fitness-plan generator. In the context of a health/fitness skill, undisclosed payment and external resource orchestration increases the attack surface and can exfiltrate user prompts or unexpectedly monetize interactions through an off-platform service.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code invokes an external alipay-bot CLI to complete payment and query order status, which is unrelated to generating a workout plan and introduces a powerful execution and commerce boundary. In this skill context, that mismatch is especially risky because users would not reasonably expect local command execution tied to payments from a fitness-planning tool.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill documents executable shell commands and a payment workflow, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, this can lead to overbroad shell access assumptions and increases the chance that an agent executes commands the skill author did not tightly constrain.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The display name and the entire user-facing skill description are presented only in Chinese, with no indication that users may choose another language. Under the policy, language constraints should be optional or explicitly justified when the skill is not clearly region-specific.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description lists activation phrases such as “增肌”, “减脂”, and “每周练几天”, which are common fitness terms and everyday questions rather than clearly bounded invocation triggers. The file does not provide exclusion conditions or negative examples to clarify when these phrases should or should not activate the skill.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Using npx -y @alipay/agent-payment@latest install pulls and executes the latest package version at runtime, which is a classic supply-chain risk. If the upstream package is compromised or a breaking version is published, an agent or user may execute unreviewed code with local system access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file’s descriptive comments and runtime guidance are entirely in Chinese, and the command errors/instructions throughout the script also assume Chinese-speaking users. Under the policy, forcing a specific language without opt-in or justification is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The script instructs users to install and trust a remote package using @latest, which is an unpinned supply-chain dependency. If the upstream package is compromised or a malicious version is published, users could install and execute attacker-controlled code on their system during the payment flow.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The payment intent summary says 种草图文笔记创作 rather than anything related to fitness-plan generation, directly contradicting the skill identity. This inconsistency is a strong indicator of repurposed or deceptive payment logic and could mislead users about what they are authorizing or reveal code copied from another skill without proper review.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The runtime error message again directs users to install @alipay/agent-payment@latest, reinforcing execution of an unpinned third-party package. This creates a repeatable supply-chain risk because users may follow the remediation path under failure conditions without verifying what code is being installed.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.