utility-allocation-check-free

Warn

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: MEDIUMPROMPT_INJECTIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The SKILL.md file contains a 'Need a full version' section with a block of text intended to be processed by the AI. This text instructs the agent to override standard behavior by pre-authorizing the installation of dependencies and initiating a purchase workflow for an external skill.
  • [REMOTE_CODE_EXECUTION]: The skill's documentation directs the agent to execute npx -y @alipay/agent-payment@latest install. This command fetches and executes code from the public NPM registry at runtime. While the package belongs to a known organization, the use of unpinned versions and automated execution via AI instructions is a high-risk pattern.
  • [COMMAND_EXECUTION]: The skill explicitly requests Bash access and provides shell commands in its instructions for the agent to perform system-level tasks like package installation.
  • [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface where instructions embedded in the SKILL.md file can influence the agent's future actions.
  • Ingestion points: SKILL.md (instructions and upsell prompt).
  • Boundary markers: Absent; the instructions are presented as direct commands for the AI.
  • Capability inventory: Bash (via tool configuration), Read (to access other skills).
  • Sanitization: None; external prompts are interpolated directly into the agent's context.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 16, 2026, 11:28 AM
Security Audit — agent-trust-hub — utility-allocation-check-free