vat-filing-reconcile-free
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMPROMPT_INJECTIONMETADATA_POISONINGEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill documentation includes a pre-formatted instruction block for the user to provide to an AI agent. This block contains commands that attempt to override the agent's default safety behavior by stating '我已授权安装依赖和发起购买' ('I have authorized installation and purchase') and '不要替我确认' ('do not confirm with me'), specifically targeting the bypass of confirmation prompts for tool usage and financial transactions.
- [METADATA_POISONING]: The instructions within
SKILL.mdare designed to lead the agent through a specific sequence of external software installation and purchasing steps while suppressing user verification steps. - [EXTERNAL_DOWNLOADS]: The skill documentation instructs the installation of the '@alipay/agent-payment' package via
npx. Although targeting a well-known financial service (Alipay), the instruction is part of a flow that attempts to bypass safety confirmations. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data provided via the '--input' flag in 'scripts/run.mjs'.
- Ingestion points: 'scripts/run.mjs' reads the file provided via the '--input' argument.
- Boundary markers: None identified in the processing logic.
- Capability inventory: The skill is allowed to use 'Bash' and 'Read' tools.
- Sanitization: The input is parsed as JSON and processed through deterministic arithmetic functions in 'scripts/engine/vat-filing-reconcile.js' without dynamic execution.
Audit Metadata