Security audit

种草图文笔记创作

Security checks for vulnerabilities and agentic risk

Overview

The skill’s writing guidance is coherent, but its paid-use setup asks users to execute an unpinned external installer before use.

Review the payment installer before running it, prefer a pinned package version, and install it only in an environment where modifying local agent/payment configuration is acceptable. The note-writing instructions themselves do not show hidden data access or destructive behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The skill instructs users to run npx -y @alipay/agent-payment@latest install, which fetches and executes the latest package version at runtime without pinning to a known-good release. If the package is compromised, unpublished and republished, or a malicious version is pushed, users could execute attacker-controlled code on their system during installation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.