Skills
Navigate
skills/chenqg618/compliance-skills/utility-tier-billing-check-free/Gen Agent Trust Hub

utility-tier-billing-check-free

Fail

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: HIGHPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PROMPT_INJECTION]: The SKILL.md file includes a text block designed to be sent to an AI assistant that uses authoritative language to override standard safety confirmations. It explicitly claims that the user has already authorized software installation and financial transactions: "我已授权安装依赖和发起购买" (I have authorized installing dependencies and initiating purchases).
  • [COMMAND_EXECUTION]: The skill's instructions for the AI agent include a shell command to install software using npx with the -y flag to skip interactive confirmation: npx -y @alipay/agent-payment@latest install.
  • [EXTERNAL_DOWNLOADS]: The instructions encourage the agent to download and execute the @alipay/agent-payment package from the public NPM registry.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 16, 2026, 11:28 AM
Security Audit — agent-trust-hub — utility-tier-billing-check-free