loan-rate-disclosure

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:43 PM UTC
• Version: 1.0.0

Overview

The skill is a small local loan-rate checker, but its unpinned global npx install path and invalid-number false PASS behavior warrant review before use.

Install only from a pinned, reviewed version or commit, avoid running the npx command with elevated privileges, and do not rely on the checker as an automated compliance gate until numeric input validation is fixed; treat outputs as preliminary screening requiring human review.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:78
• Finding: Unpinned Third-Party Package Execution During Installation## Vulnerability Details **File Location**: `SKILL.md:78` **Vulnerability Type**: Supply-chain risk from unpinned package execution **Risk Level**: Medium **Vulnerable Code**: ```bash npx skills add zhaoxinghua09-cell/agent-skills -g ``` ### Technical Analysis The documented installation command invokes the `skills` package through `npx` without specifying a package version or integrity constraint. If the package is not already available locally, `npx` may download the currently published version from the configured package registry and execute it. Consequently, the code executed during installation is mutable and is not fully represented by the audited project. A compromised package release, package-owner account, registry response, or dependency in the package's transitive supply chain could cause arbitrary code to run when a user follows the installation instructions. The referenced skill repository is also not pinned to a commit hash in this command. The combination of an unpinned installer and mutable source reference prevents users from reliably reproducing the reviewed installation state. ### Attack Path 1. An attacker compromises the package, its publisher account, the package registry, or a transitive dependency used by the `skills` CLI. 2. The attacker publishes or serves a malicious version under the expected package name. 3. A user follows the installation instructions and runs the documented `npx skills add ... -g` command. 4. `npx` resolves and downloads the mutable package version. 5. The malicious CLI, lifecycle logic, or dependency executes with the privileges of the invoking user. 6. The payload can access resources available to that user and may modify globally managed skill files because the command requests global installation. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the installing user's account. The accessible scope may include the user's f ...[truncated 469 chars]
• Remediation: ## Remediation Suggestions 1. Pin the installer to a reviewed, immutable version, for example by using an explicit package version rather than the latest registry version. 2. Publish and verify the expected package integrity hash or signed provenance before execution. 3. Pin the installed skill source to a specific reviewed commit or immutable release artifact. 4. Avoid global installation unless it is operationally required; prefer a scoped local installation with least privilege. 5. Document the expected registry, publisher identity, package version, source commit, and checksum. 6. Provide a manual installation procedure that downloads a versioned artifact, verifies its checksum or signature, and copies only the reviewed files without executing a mutable installer. 7. Advise users not to run the installation command with administrator or root privileges.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/loan_rate_disclosure.py:5
• Finding: Non-Finite and Invalid Numeric Inputs Can Produce False PASS Results## Vulnerability Details **File Location**: `scripts/loan_rate_disclosure.py:5-6, 18-25` **Vulnerability Type**: Missing numeric input validation **Risk Level**: Medium **Vulnerable Code**: ```python ap.add_argument("--rate", type=float, help="对外报价利率（百分比，如 24 表示 24%）") ap.add_argument("--base", type=float, default=3.85, help="参考基准利率LPR（百分比，默认3.85）") ``` ```python if a.rate is not None: mult = a.rate / a.base if a.base else 0 cap = 4 * a.base over = a.rate > cap checks.append({"check": "利率/基准倍数", "value": round(mult, 2), "cap_multiple": 4, "ok": not over}) if over: problems.append("报价 %.2f%% 超过基准 %.2f%% 的4倍上限（%.2f%%），触及民间借贷司法保护上限风险" % (a.rate, a.base, cap)) ``` ### Technical Analysis The CLI relies on Python's `float()` conversion but does not verify that `--rate` and `--base` are finite, positive, and within a valid business range. Python accepts special floating-point strings such as `nan`, `inf`, and `-inf`. IEEE-754 NaN values do not compare as greater than ordinary values. Therefore, when `a.rate` or `a.base` is NaN, the expression `a.rate > cap` evaluates to false. The code then records the check as successful through `"ok": not over`, appends no problem, and exits with status zero. The code also permits negative rates and negative base values. In addition, a zero base is silently converted into a multiplier of zero rather than being rejected as invalid. These cases can generate misleading calculations and compliance outcomes instead of a usage error. ### Attack Path 1. An attacker or untrusted upstream system controls the command-line values passed to the checker. 2. The attacker supplies a non-finite value, such as `--rate nan`, or supplies `--base nan` with an otherwise excessive rate. 3. `argparse` accepts the value because Python's `float()` conversion recognizes `nan`. 4. Arithmetic propagates the NaN value into the multiplier or cap. 5. The comparison used to d ...[truncated 872 chars]
• Remediation: ## Remediation Suggestions 1. Validate both values with `math.isfinite()` before performing calculations. 2. Require `rate` to be non-negative and `base` to be strictly greater than zero. 3. Define and enforce reasonable upper bounds for both inputs based on the tool's supported domain. 4. Treat rejected values as usage errors and exit with status `2`, consistent with the documented interface. 5. Do not silently substitute a multiplier of zero when the base is zero. 6. Consider parsing decimal user input with `decimal.Decimal` if deterministic decimal behavior is required. 7. Add regression tests for `nan`, positive and negative infinity, zero base, negative values, extreme values, and valid boundary values. A minimum validation pattern would be: ```python import math if a.rate is not None and (not math.isfinite(a.rate) or a.rate < 0): ap.error("--rate must be a finite, non-negative number") if not math.isfinite(a.base) or a.base <= 0: ap.error("--base must be a finite number greater than zero") ```

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence
• Finding: The skill instructs users to run `npx skills add ...` without pinning an exact package version, which can cause execution of whatever version is currently resolved from the registry at install time. If the upstream package is compromised, typo-squatted, or a malicious update is published, users may execute unreviewed code during installation, making this a real supply-chain risk.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The user-facing argparse description, argument help strings, and error message are written only in Chinese. This imposes a specific language for interaction without any opt-in or alternative locale, which fits the policy-violation category for language/locale constraints.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: This markdown file includes core descriptive content in Chinese, and there is no indication that users may choose another language or that the locale restriction is intentional and documented. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The English description still embeds the Chinese term "金融" rather than fully localizing or offering a user language choice. This suggests the skill presentation assumes a specific language context without explicit opt-in, which can conflict with language/locale policy requirements.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The manifest sets the category to "AI 治理", which imposes a specific language in user-visible metadata without any indication of user opt-in or that the skill is intentionally limited to a Chinese-language context. Under the policy for natural-language violations, forcing a locale or language without documented choice or justification should be flagged.

Static analysis

No suspicious patterns detected.