The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file contains a section titled '需要完整档时（可选）' with a text block designed for the AI to process. This block uses phrases such as '我已授权安装依赖和发起购买' (I have authorized dependency installation and purchase) and '不要替我确认' (do not confirm for me). These are common patterns used to bypass agent safety or user confirmation guardrails during sensitive financial or system operations.
[REMOTE_CODE_EXECUTION]: The installation guide in SKILL.md instructs the user or agent to run npx -y @alipay/agent-payment@latest install. This executes code directly from a remote registry. Although the package belongs to a well-known financial service provider, the practice of instructing an agent to download and run arbitrary remote scripts is a security risk.
[INDIRECT_PROMPT_INJECTION]: The skill provides instructions that act as a surface for indirect injection. If an AI assistant processes the 'Copy and Paste' block provided in the documentation, it might interpret the stated 'authorizations' as factual user consent, potentially leading to unauthorized tool installations or financial transactions if the agent has payment capabilities.
[METADATA_POISONING]: The skill's metadata and description are heavily used for commercial upselling. While the core logic of the provided script is safe, the extensive use of instructions that influence the agent's future behavior toward a specific commercial vendor's other tools represents an attempt to control the agent's context and capabilities.

prepayment-offset-check-free