travel-rule-check

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:50 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent travel-rule checking CLI, but it handles sensitive KYC transaction data through command-line arguments and can incorrectly pass malformed amounts as compliant.

Review before installing. Use only synthetic data with the current --tx interface, or modify it to read real KYC data from stdin or a protected file. Do not rely on this as a sole compliance gate until amount validation rejects NaN, infinity, negative, missing, and non-currency values. Avoid the unpinned npx global install unless you have verified the installer package and source revision.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:76
• Finding: Unpinned External Package Execution During Installation## Vulnerability Details **File Location**: `SKILL.md:76` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ```bash npx skills add zhaoxinghua09-cell/agent-skills -g ``` ### Technical Analysis The documented installation command invokes `npx` without specifying an exact version or integrity digest for the `skills` package. Depending on the local environment, `npx` may download and execute the currently published package from an external registry. Consequently, the code executed during installation is mutable and falls outside the reviewed project artifact. If the package, publisher account, registry resolution process, or a transitive dependency is compromised, the installation command may execute code different from the code that was originally reviewed. ### Attack Path 1. An attacker compromises the package publisher, package registry entry, or a dependency used by the unpinned `skills` package. 2. The attacker publishes a malicious version under the package name resolved by `npx`. 3. A user follows the installation command in `SKILL.md`. 4. `npx` downloads and executes the malicious or unexpected package version. 5. The package executes with the privileges of the invoking user and performs arbitrary actions permitted to that account. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the installing user's privileges. The attacker could access user-readable files, modify user-owned configuration, steal credentials available to the process, or install modified Skill content. The `-g` option also increases the scope of package installation by requesting a global Skill installation, although it does not itself prove operating-system privilege escalation.
• Remediation: ## Remediation Suggestions - Pin the installer package to a reviewed, exact version rather than resolving the latest available release. - Where supported, verify the downloaded package with an integrity hash or signed provenance record. - Document the expected package registry and publisher identity. - Avoid global installation unless it is necessary for the Skill's operation. - Prefer a reviewed local installation mechanism that does not execute mutable remote package code. - If the installer must already exist locally, use a mode equivalent to `npx --no-install` to prevent implicit downloads. - Review and lock all transitive dependencies used by the installer.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/travel_rule_check.py:22
• Finding: Sensitive KYC Information Is Accepted Through Process Arguments## Vulnerability Details **File Location**: `scripts/travel_rule_check.py:22-25` **Vulnerability Type**: Exposure of personal and financial information through command-line arguments **Risk Level**: Medium ```python ap.add_argument("--tx", help="转账 JSON: {originator:{name,account,geo}, beneficiary:{...}, amount}") ap.add_argument("--json", action="store_true") a = ap.parse_args() if not a.tx: print("用法: --tx <JSON>", file=sys.stderr); sys.exit(2) try: tx = json.loads(a.tx) ``` ### Technical Analysis The application requires transaction JSON to be supplied through the `--tx` command-line option. The expected payload contains originator and beneficiary names, account or wallet identifiers, geographic information, and a transaction amount. Command-line arguments are not a confidential input channel. Depending on the operating system and execution environment, they may be exposed through process-listing facilities, shell history, terminal recording, CI/CD logs, job metadata, monitoring agents, crash diagnostics, or support bundles. The script does not warn users about this exposure or provide a safer standard-input or protected-file alternative. ### Attack Path 1. A user invokes the checker with real KYC data in the `--tx` argument. 2. The shell records the command in its history, or the operating system exposes the argument through process inspection while the command is running. 3. Another local user, administrator, monitoring system, or log consumer obtains the recorded command. 4. The observer extracts participant names, account or wallet identifiers, geographic data, and transaction details from the argument. ### Impact Assessment Exploitation does not grant additional system privileges, but it can disclose sensitive personal and financial data available in submitted transactions. Exposure may affect both transaction participants and may create privacy, confidentiality, and regulatory risks. The scope depend ...[truncated 107 chars]
• Remediation: ## Remediation Suggestions - Accept transaction JSON through standard input so sensitive values do not appear in the process argument list. - Alternatively, support reading from a user-specified file and require or validate restrictive file permissions. - Retain `--tx` only for synthetic test data, if it must remain supported, and display a clear warning that it is unsuitable for real KYC information. - Avoid printing or logging complete transaction objects. - Redact names, account identifiers, addresses, and geographic values from errors and diagnostics. - Document secure invocation patterns for interactive shells, automation systems, and CI/CD environments. - Add tests confirming that normal secure usage does not place KYC data in command-line arguments or application logs.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/travel_rule_check.py:10
• Finding: Malformed Monetary Values Can Bypass Threshold-Based KYC Enforcement## Vulnerability Details **File Location**: `scripts/travel_rule_check.py:10-13` **Vulnerability Type**: Insufficient validation of security-sensitive monetary input **Risk Level**: Medium ```python def check(tx): amt = float(tx.get("amount", 0) or 0) o = tx.get("originator") or {} b = tx.get("beneficiary") or {} need = amt >= THRESHOLD ``` ### Technical Analysis The transaction amount is converted directly with `float()` and then compared with the fixed threshold. The code does not verify that the value is finite, non-negative, expressed in an expected currency, or otherwise valid for use as a monetary amount. Python accepts values such as `"NaN"` during floating-point conversion. A NaN value is unordered, so `float("NaN") >= 1000` evaluates to false. Negative amounts also evaluate below the threshold. In either case, `need` becomes false and geographic information is no longer required, despite the input being invalid rather than a legitimate below-threshold transaction. Because compliance is determined solely by whether the resulting `missing` list is empty, a malformed amount combined with names and account identifiers can produce a compliant result. ### Attack Path 1. An attacker or upstream system supplies transaction JSON containing an amount such as `"NaN"` or a negative number. 2. `float()` accepts the value. 3. The threshold comparison evaluates to false. 4. The checker does not require geographic information for either participant. 5. If the remaining name and account or address fields are populated, the script returns `"compliant": true` and exits with status `0`. 6. A downstream workflow that treats the exit status as a compliance gate may accept the malformed transaction. ### Impact Assessment Exploitation does not provide operating-system privileges or arbitrary code execution. It undermines the integrity of the compliance decision and can allow incomplete or invalid tran ...[truncated 215 chars]
• Remediation: ## Remediation Suggestions - Parse monetary values with `decimal.Decimal` rather than binary floating-point arithmetic. - Reject booleans, missing values, empty strings, NaN, positive or negative infinity, negative values, and unsupported numeric formats. - Require an explicit currency or a validated normalized USD-equivalent amount before applying the threshold. - Treat invalid amounts as input errors and exit with status `2`, rather than treating them as below-threshold transactions. - Validate that the top-level JSON value is an object and that party records have the expected object types. - Add regression tests for `"NaN"`, `"Infinity"`, `"-Infinity"`, negative amounts, booleans, null values, malformed numeric strings, and values immediately around the threshold. - Ensure downstream systems distinguish invalid input from a valid compliant result.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The skill documentation is predominantly Chinese, including the purpose, usage context, and compliance descriptions, with no indication that users may choose another language. This creates a language/locale policy concern because the skill effectively requires Chinese comprehension without documented opt-in or justification.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file uses Chinese for the display name, description, headings, and operational guidance, while not providing an explicit user option to choose another language for usage instructions. This can violate a language/locale policy when users are forced into a specific language without opt-in.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The skill instructs users to run `npx skills add ...` without pinning a specific package version. Because `npx` resolves the latest package by default, a compromised upstream package, typosquat, or unexpected breaking update could cause users to execute unreviewed code at install time. In this context, the danger is increased because the file is an installation guide for an agent skill, so users are explicitly being told to fetch and run remote tooling.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: This file uses bilingual Chinese/English text throughout, but it does not state whether users may choose a preferred language or whether the locale choice is required for a specific audience. Under the natural-language policy rule, forced or undocumented language assumptions can be a policy concern when no opt-in or justification is provided.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: The manifest uses a Chinese-only category label ("AI 治理"), which indicates a fixed language choice in user-facing metadata. There is no accompanying indication that the skill is region-specific or that users can opt into this locale, which may conflict with language/locale policy expectations.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The docstring, CLI help text, error messages, and normal output are all hard-coded in Chinese. This imposes a specific language on users without any opt-in or documented locale constraint, which matches the language-policy violation criteria.

Static analysis

No suspicious patterns detected.