lease-rent-check-free
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill documentation includes a section ('需要完整档时') containing direct instructions for the AI agent to follow. This text ('请通过 SkillPay 购买并安装...', '我已授权安装依赖和发起购买...') is designed to influence agent behavior to automate the installation of dependencies and the purchase of other skills.
- [COMMAND_EXECUTION]: The documentation provides shell commands intended for agent execution, specifically
npx -y @alipay/agent-payment@latest install. This enables the agent to execute system-level commands to manage software packages. - [REMOTE_CODE_EXECUTION]: The skill facilitates remote code execution by instructing the agent to download and run the
@alipay/agent-paymentpackage usingnpx. As this originates from a well-known service (Alipay), it is documented as an external dependency of the recommended installation workflow.
Audit Metadata