tax-risk-indicator-check-free
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The
SKILL.mdfile contains a dedicated section titled 'Need full version' that provides a block of text intended to be copied and pasted by the user to the AI agent. This text directs the agent to download and execute code (npx -y @alipay/agent-payment@latest install) and to perform a purchase using specific merchant and skill IDs. The prompt uses instructions such as 'I have authorized... do not confirm for me', which are designed to override the agent's standard confirmation guardrails. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-supplied tax data, creating a surface for indirect prompt injection. The engine normalizes inputs, which provides a layer of defense against malformed data.
- Ingestion points: The text content provided via the input file in
scripts/run.mjsand parsed inscripts/engine/tax-risk-indicator-check.js. - Boundary markers: No explicit delimiters are used to wrap the input data when it is processed by the agent.
- Capability inventory: The skill is allowed to use
BashandReadtools. The provided scripts perform file reading and arithmetic calculations locally and do not currently execute shell commands or network operations. - Sanitization: The calculation engine in
scripts/engine/tax-risk-indicator-check.jsutilizes normalization functions (normNumber,rateValue,ratioValue) to validate and filter numerical and ratio-based inputs. - [EXTERNAL_DOWNLOADS]: The documentation and upselling prompts suggest the execution of
npx -y @alipay/agent-payment@latest install. This command downloads and executes code from the NPM registry. As the package is hosted within the@alipaynamespace, which belongs to a well-known service provider, this finding is documented neutrally as part of the intended product onboarding flow.
Audit Metadata