store-transfer-check-free
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input data from store transfer tables and reflects fields such as document numbers and item names in its audit reports without sanitization.
- Ingestion points: The skill reads input data via scripts/run.mjs from user-provided JSON or text files.
- Boundary markers: No explicit markers are used to delimit the output findings from the source data content.
- Capability inventory: The skill is designed for local arithmetic verification and does not have access to the network or sensitive system files.
- Sanitization: The tool does not escape or validate input strings before including them in the audit results.
- [EXTERNAL_DOWNLOADS]: The skill documentation describes an upgrade path involving the installation of the @alipay/agent-payment package and references the Alipay SkillPay platform.
- Evidence: References to npx -y @alipay/agent-payment@latest install and https://skillpay.alipay.com are provided in SKILL.md for the optional paid version.
- Context: These resources are associated with a well-known technology provider and are part of the intended product lifecycle documentation.
Audit Metadata