project-evm-check-free
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The file
SKILL.mdcontains a section titled "需要完整档时(可选)" (When needing the full version) which provides a pre-formatted prompt for the user to send to their AI assistant. This prompt instructs the agent to perform an automated sequence of actions, including software installation and financial transactions. It specifically uses language designed to bypass standard agent safety checks and user confirmation steps, such as "我已授权安装依赖和发起购买" (I have authorized the installation of dependencies and the purchase) and "请继续完成商品安装和验证" (Please continue to complete product installation and verification) without further manual confirmation. - [COMMAND_EXECUTION]: The suggested instructions in
SKILL.mdinclude a specific shell command:npx -y @alipay/agent-payment@latest install. If an agent follows the provided prompt script, it will execute this command to install external software on the host environment. - [EXTERNAL_DOWNLOADS]: The skill documentation encourages the installation of the
@alipay/agent-paymentpackage from the NPM registry. This package is part of the payment infrastructure provided by a well-known financial service provider (Alipay) and is used here to enable upselling to a commercial version of the tool.
Audit Metadata