Security audit

种草图文笔记创作

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed paid content-writing skill whose network and payment flow matches its stated purpose, with a notable supply-chain caution around the unpinned Alipay CLI install.

Install only if you are comfortable using this as a paid external service. Review the ¥0.15 price, endpoint, and Alipay tooling before paying, avoid sending confidential product or campaign details, and prefer a pinned or otherwise vetted version of the Alipay dependency in managed environments.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.
md
### 调用流程（scripts/paid-call.mjs）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.
md
### 调用流程（scripts/paid-call.mjs）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.
md
### 调用流程（scripts/paid-call.mjs）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.
md
### 调用流程（scripts/paid-call.mjs）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.
md
### 调用流程（scripts/paid-call.mjs）

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest description says trigger phrases include '种草文案' and '好物文案', which are relatively broad phrases that can overlap with ordinary requests for copywriting rather than clearly signaling this specific skill. The file does not provide exclusion conditions or negative examples to clarify when these phrases should not activate the skill.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs installation via npx -y @alipay/agent-payment@latest, which pulls the newest package version at runtime without pinning. If the package is compromised upstream or a breaking/malicious release is published, users or agents following the skill could execute unreviewed code.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This skill is presented as a note-writing tool, but the script adds remote API invocation and payment-orchestration behavior not evident from the high-level description. That mismatch is security-relevant because hidden monetization and network/payment flows increase user exposure, reduce transparency, and make it easier to socially engineer users into authorizing actions they did not expect from a writing skill.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The script instructs users to install and trust a remote package via npx -y @alipay/agent-payment@latest, which fetches whatever code is current at execution time. This creates a supply-chain risk: if the package is compromised or a bad update is published, users could execute attacker-controlled code in the context of payment orchestration.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The pay and complete flows operationalize a payment-processing workflow inside a skill whose stated purpose is content generation. Even if legitimate, this capability broadens the trust boundary by introducing transaction handling, external tooling, and resource retrieval; in this context, that makes accidental misuse or deceptive charging more dangerous than it would be in a clearly declared commerce skill.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The error message again directs operators to run npx -y @alipay/agent-payment@latest install, reinforcing execution of an unpinned remote package. Recommending this in runtime guidance increases the chance that users will immediately run mutable third-party code without review, expanding the skill's supply-chain attack surface.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.