aml-sentinel

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:08 PM UTC
• Version: 1.0.0

Overview

The skill is mostly a local AML transaction checker, but it should go to Review because it recommends mutable global installation and has input-validation flaws that can understate AML risk.

Review before installing. Prefer a pinned release or verified commit instead of the documented global npx/Git install, avoid using this as an automated compliance gate without schema validation, and treat outputs as advisory only with human review for real AML decisions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:76
• Finding: Unpinned Remote Installation Chain Permits Supply-Chain Substitution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:76-80` **Vulnerability Type**: Unpinned third-party package and mutable repository installation **Risk Level**: Medium ### Vulnerable Code ```bash # One-click installation using the skills CLI npx skills add zhaoxinghua09-cell/agent-skills -g # Alternatively, clone and copy the skill manually git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cp -r agent-skills/skills/aml-sentinel ~/.workbuddy/skills/ ``` ### Technical Analysis The documented installation procedure executes an unpinned npm CLI through `npx` and retrieves an unpinned, mutable Git repository branch. Neither command binds the installed content to a reviewed package version, Git commit, release artifact, checksum, or cryptographic signature. Consequently, the content installed by a user can differ from the artifact covered by this audit. If the npm package, publishing account, source repository, maintainer account, or upstream delivery channel is compromised, an attacker can replace the expected skill with modified instructions or executable scripts. The `-g` installation option and subsequent copying into an Agent skill directory increase the potential scope: malicious content may become available across multiple Agent sessions rather than being confined to a temporary project environment. ### Attack Path 1. An attacker compromises the npm package, the repository, or an authorized maintainer account. 2. The attacker publishes a modified package version or changes the repository's default branch. 3. A user follows the documented `npx skills add ... -g` or `git clone` command. 4. The installation retrieves the attacker's current content rather than the reviewed artifact. 5. The malicious skill is placed in a global or persistent Agent skill directory. 6. When the Agent loads the altered instructions or invokes an altered script, attacker-controlled behavior executes under the user's privileges. ### Impact Assessme ...[truncated 497 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the npm CLI or package to a reviewed version rather than relying on the latest available release. 2. Pin Git installations to an immutable commit hash or signed release tag. 3. Publish SHA-256 checksums for release artifacts and document how users should verify them before installation. 4. Cryptographically sign releases and verify signatures as part of installation. 5. Avoid global installation by default; prefer a project-scoped directory with minimal permissions. 6. Install only the specific skill artifact instead of cloning an entire mutable repository. 7. Add provenance metadata tying the package version, Git commit, and artifact checksum to the audited release. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/aml_sentinel.py:10
• Finding: Permissive JSON Type Coercion Allows AML Detection Bypass<![CDATA[ ## Vulnerability Details **File Location**: `scripts/aml_sentinel.py:10-21` **Vulnerability Type**: Missing schema validation and unsafe boolean/numeric coercion **Risk Level**: High ### Vulnerable Code ```python amt = float(tx.get("amount", 0) or 0) kyc = bool(tx.get("counterparty_kyc")) cross = bool(tx.get("cross_border")) structured = bool(tx.get("structured")) freq = int(tx.get("freq", 0) or 0) fast = bool(tx.get("fast_in_out")) if amt >= 50000 and not tx.get("reported"): hits.append("大额未报备") if (amt >= 50000 or cross) and not kyc: hits.append("无对手KYC") if cross and not kyc: hits.append("跨境无KYC") if structured: hits.append("拆分/结构化交易") if fast and freq >= 3: hits.append("快进快出+高频") ``` ### Technical Analysis The scanner does not validate input against a strict schema. It converts values with Python's generic `bool`, `float`, and `int` functions and tests `reported` directly for truthiness. In Python, any non-empty string is truthy. Thus, JSON values such as `"false"` are interpreted as true when passed to `bool()` or evaluated directly. Examples include: - `"counterparty_kyc": "false"` becomes `True`, suppressing missing-KYC findings. - `"reported": "false"` is truthy, suppressing the large-unreported-transaction finding. - `"cross_border": "false"` becomes `True`, creating inconsistent scoring and findings. - `"structured": "false"` and `"fast_in_out": "false"` also become `True`. The amount parser also accepts non-finite floating-point values. For example, `float("NaN")` produces a NaN value rather than rejecting the input. Comparisons such as `amt >= 50000` evaluate to false for NaN, permitting amount-based checks to be bypassed. Because each finding contributes to the score and a transaction is marked high risk only when the score reaches 70, suppressing findings can materially change the final compliance decision and exit code. ### Attack Path 1. An attacker or upstream data producer submits a transaction through `--tx` or a JSONL file ...[truncated 1387 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Define and enforce a strict transaction schema before evaluating any rule. 2. Require boolean fields to be actual JSON booleans: ```python def require_bool(tx, key): value = tx.get(key) if not isinstance(value, bool): raise ValueError(f"{key} must be a JSON boolean") return value ``` 3. Reject booleans and strings where numeric values are expected, because Python booleans are subclasses of integers. 4. Validate amounts with `math.isfinite()` and require non-negative values: ```python import math value = tx.get("amount") if isinstance(value, bool) or not isinstance(value, (int, float)): raise ValueError("amount must be a JSON number") amount = float(value) if not math.isfinite(amount) or amount < 0: raise ValueError("amount must be finite and non-negative") ``` 5. Validate `freq` as a non-negative integer and reject floating-point or string representations. 6. Treat missing mandatory fields as input errors rather than silently substituting permissive defaults. 7. Return exit code `2` with a controlled validation message for malformed records. 8. Add regression tests covering string booleans, null values, missing fields, NaN, infinity, negative amounts, oversized numbers, and mixed-type JSONL records. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The code substantially matches the transaction-monitoring portion of the description: it detects the listed AML patterns, computes risk, supports single or batch transaction input, and outputs risk conclusions. However, the description also claims broader '对 AI 系统/数据做可执行合规校验' capability. Nothing in the supplied code inspects AI systems, models, prompts, policies, or general datasets for compliance; it only evaluates transaction fields via fixed heuristics. That extra declared capability is materially unsupported by the code, so this is a description-behavior mismatch.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The skill description is entirely in Chinese and does not indicate that other languages are supported or that Chinese is required for a region-specific compliance context. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The installation instruction uses `npx skills` without pinning an exact package/version, which can cause users to fetch and execute whatever package currently resolves from the registry at install time. In a skill-distribution context, this creates a supply-chain execution risk if the package is updated maliciously, typosquatted, or compromised, and the skill text explicitly encourages users to run it.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This Python file contains the module docstring, CLI help text, error messages, and output strings entirely in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: This attestation is presented primarily in Chinese with an English header and several English terms, but it does not indicate that the language choice is optional or justified by a region-specific requirement. Under the policy rule for language/locale, forcing a specific language without user opt-in can be a natural-language policy concern.

Static analysis

No suspicious patterns detected.