warehouse-inventory-turnover-check-free
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMMETADATA_POISONINGREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The skill is marketed as a 'free' and 'no-network' tool in its summary and descriptions. However, the content of the skill is heavily oriented towards upselling a 'Buyout Version' (买断版). It provides a pre-written instruction block for users to feed to their AI agent, which overrides the current context to automate the purchase and installation of external software through SkillPay.
- [REMOTE_CODE_EXECUTION]: The upsell instructions provided within the skill body command the agent to run
npx -y @alipay/agent-payment@latest install. This command downloads and executes code from the NPM registry. While the package belongs to a known service, using a utility skill to trigger the installation of third-party execution environments represents a supply-chain and remote code execution risk. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes user-provided inventory data in plain text via the
--inputflag inscripts/run.mjs. There is no evidence of sanitization or the use of boundary markers to prevent the agent from following instructions potentially embedded in these data files. - Ingestion points: The
loadInputfunction inscripts/run.mjsreads file content directly into the agent's processing logic. - Boundary markers: No delimiters or 'ignore embedded instructions' warnings are used when processing the inventory text.
- Capability inventory: The skill has access to the
BashandReadtools, and the script can execute arbitrary shell commands via the node environment. - Sanitization: The engine only performs basic table parsing and arithmetic checks, with no logic to filter or escape instructions in the input text.
Audit Metadata