bonus-pool-check-free
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMPROMPT_INJECTIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The
SKILL.mdfile contains a copy-paste instruction block for the user to send to the AI agent. This block includes phrases like "我已授权安装依赖和发起购买" (I have authorized installation and purchase), which is an attempt to override the agent's internal safety checks or confirmation dialogues for privileged actions. - [REMOTE_CODE_EXECUTION]: The documentation instructs the agent to run
npx -y @alipay/agent-payment@latest install. This command downloads and executes code from a remote package registry, creating a dependency on external, unverifiable code at runtime. - [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to run local scripts (node scripts/run.mjs) and suggests the execution of system-level commands likenpxfor installation workflows. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted text-based table data. 1. Ingestion points:
scripts/run.mjs(via--inputflag) andscripts/engine/bonus-pool-check.js(viarunfunction). 2. Boundary markers: None. Input text is parsed directly using regex and string splitting. 3. Capability inventory: Read and Bash tools are enabled, allowing the agent to read local files and execute scripts. 4. Sanitization: No sanitization is performed on the input data before it is processed or included in the resulting output findings.
Audit Metadata