Security audit

家常菜谱生成

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed paid recipe generator, but its payment command labels the purchase as an unrelated content-writing service and uses an unpinned remote installer.

Review this skill before installing. The paid recipe workflow is disclosed and low-cost, but do not proceed unless you are comfortable installing an unpinned Alipay payment package and you can verify that the payment prompt describes recipe generation, not the unrelated content-writing label present in the script.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.
md
### 调用流程（scripts/paid-call.mjs）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.
md
### 调用流程（scripts/paid-call.mjs）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.
md
### 调用流程（scripts/paid-call.mjs）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.
md
### 调用流程（scripts/paid-call.mjs）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.
md
### 调用流程（scripts/paid-call.mjs）

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The payment intent summary says 种草图文笔记创作 while the skill is a home recipe generator, indicating a deceptive mismatch in what the user is told they are paying for. Mislabeling payment purpose can mislead users, impair informed consent, and hide unauthorized or unrelated billing activity, which is especially concerning in a consumer-facing skill.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Using npx -y @alipay/agent-payment@latest install pulls and executes the latest package version at runtime without pinning, which creates a supply-chain risk. If the package is compromised or a breaking/malicious update is published, users or agents following the instructions could execute unreviewed code.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: 技能清单将该技能描述为根据食材和口味生成家常菜谱，但此脚本实际实现的是一个三阶段的付费购买/取回资源流程，并通过 curl 与远程资源接口、通过 alipay-bot 与支付系统交互。支付编排不是清单描述中直接体现的能力，因此代码行为明显超出了单纯“生成菜谱”的语义范围。
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The script instructs users to install and run @alipay/agent-payment@latest via npx, which fetches whatever version is current at execution time. This creates a supply-chain risk: if the package is compromised or a breaking/malicious version is published, users of this skill may execute unreviewed code on their machines.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: 对于一个“家常菜谱生成”技能，直接调用 alipay-bot 执行 402-buyer-pay 属于支付侧能力，而不是菜谱生成所必需的核心能力。若 manifest 未显式说明该技能涉及付费购买与支付编排，这种能力与技能用途不相称。
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The error path again tells users to run npx -y @alipay/agent-payment@latest install, which encourages execution of the newest remote package without pinning. Repeating the pattern in recovery guidance increases the chance that users will run untrusted code during troubleshooting.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.