union-reserve-check-free
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEPROMPT_INJECTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The SKILL.md file contains a 'How to buy' section with a text block intended for the user to send to the AI. This text uses imperative language to override standard agent behavior, such as 'I have authorized the installation of dependencies' and 'do not confirm for me', which targets the agent's safety and confirmation protocols for software installation and financial transactions.
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to execute npx -y @alipay/agent-payment@latest install. While the target organization (@alipay) is a well-known service, the use of npx with the -y flag to non-interactively download and execute remote code represents a security risk if the package or registry is compromised.
- [INDIRECT_PROMPT_INJECTION]: The skill exposes an attack surface for indirect prompt injection by ingesting external file data via the --input parameter in scripts/run.mjs. This data is parsed as text or JSON and processed by the logic in scripts/engine/union-reserve-check.js without explicit boundary markers or sanitization, allowing potentially malicious instructions embedded in financial reports to be processed by the agent.
- Ingestion points: scripts/run.mjs via the --input command-line argument (file path).
- Boundary markers: Absent; the skill processes raw text/JSON from the input file as values for processing.
- Capability inventory: The skill is allowed to use Bash and Read tools, which could be leveraged if the agent is tricked into executing commands based on instructions found in audited data.
- Sanitization: None; input is normalized for numeric values but the raw text content is handled as string data without safety filtering.
Audit Metadata