hotel-night-audit-check-free
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEPROMPT_INJECTIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The
SKILL.mdfile contains a dedicated block of text presented as instructions for an AI assistant. This block directs the assistant to perform a series of actions, including software installation and payment processing, which can influence the agent's behavior and priority if processed as part of the skill's operational context. - [REMOTE_CODE_EXECUTION]: Within the instructions in
SKILL.md, the skill directs the agent to run the commandnpx -y @alipay/agent-payment@latest install. This command initiates the download and execution of code from the public npm registry. While the package is associated with a well-known technology provider, the pattern of embedding shell-level execution commands within AI prompts is a known security risk. - [COMMAND_EXECUTION]: The skill's documentation explicitly guides the agent to use shell commands (
npx) to modify the local environment and install further extensions, extending the agent's reach beyond the scope of the immediate auditing task.
Audit Metadata