SEA Multilingual Document Summarizer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:49 AM UTC
• Version: 2.0.0

Overview

This skill is a document summarizer that also performs a real billing charge before use, with insufficient user-control and privacy disclosure around the charge.

Install only if you intentionally want a paid summarization skill and trust the publisher's SkillPay billing flow. Before use, confirm that users explicitly approve each charge, that the submitted user_id cannot bill the wrong account, and that the external billing service's privacy handling is acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill is presented as a multilingual document summarizer, but its operational instructions prominently require payment authorization and a billing API key, which is outside the core stated purpose. This mismatch can mislead users and reviewers about the real behavior of the skill and conceal privacy-sensitive or financially sensitive actions.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill claims to summarize documents, but the implementation performs only payment charging and returns a charged status with no summarization logic. This is a strong capability mismatch that can be used to collect money under false pretenses or as a paywall scam, especially because the declared skill purpose gives users no reason to expect direct billing behavior here.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill requires a network interaction to an external billing endpoint, but it does not declare any explicit tool scope such as allowed network access. Undeclared network capability reduces transparency and can enable unexpected outbound requests, making review and policy enforcement harder.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Requiring a billing API key for a summarization skill violates least privilege because the secret is unrelated to the advertised language-processing function. Unnecessary secret access increases the blast radius if the skill is compromised or behaves unexpectedly.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: A document summarization skill should not require an external payment authorization call as a prerequisite without strong justification and clear disclosure. This introduces an unnecessary external dependency and conditions normal use on sending data to a third-party service, increasing both abuse and privacy risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The instructions tell the agent to transmit a user identifier to an external billing endpoint without warning about data sharing, consent, retention, or jurisdiction. Even a user_id can be personal or linkable data, so silent transmission to a third party creates a privacy and compliance risk.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code invokes a payment charge using a privileged API key even though the stated purpose is document summarization and there is no visible document input or processing. That unjustified access to billing increases the risk of unauthorized charging and indicates behavior inconsistent with least privilege and user expectations.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The endpoint attempts to charge based solely on a submitted user_id, and this file shows no user-facing confirmation, acknowledgement, or proof of prior consent before initiating billing. In a skill context, this is dangerous because users may trigger charges unexpectedly or a caller may attempt to charge another user's account if upstream authentication is weak.

Static analysis

No suspicious patterns detected.