utility-allocation-check-free
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMPROMPT_INJECTIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The
SKILL.mdfile contains a 'Need a full version' section with a block of text intended to be processed by the AI. This text instructs the agent to override standard behavior by pre-authorizing the installation of dependencies and initiating a purchase workflow for an external skill. - [REMOTE_CODE_EXECUTION]: The skill's documentation directs the agent to execute
npx -y @alipay/agent-payment@latest install. This command fetches and executes code from the public NPM registry at runtime. While the package belongs to a known organization, the use of unpinned versions and automated execution via AI instructions is a high-risk pattern. - [COMMAND_EXECUTION]: The skill explicitly requests
Bashaccess and provides shell commands in its instructions for the agent to perform system-level tasks like package installation. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface where instructions embedded in the
SKILL.mdfile can influence the agent's future actions. - Ingestion points:
SKILL.md(instructions and upsell prompt). - Boundary markers: Absent; the instructions are presented as direct commands for the AI.
- Capability inventory:
Bash(via tool configuration),Read(to access other skills). - Sanitization: None; external prompts are interpolated directly into the agent's context.
Audit Metadata