zhongcao-cover-maker

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill is a disclosed, pinned pointer to a vendor package, but it hands a full-scope, cross-skill bearer token that includes wallet:spend to a device-wide store, sends telemetry with no opt-out, and routes that token to mainland-China hosts chosen by a remote answer, which is risky toward the user without showing malicious intent.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The only outsider-authored free text is the optional Xiaohongshu public-data lookup (notes, comments, profiles) via beatra.social.execute, which the agent runs only after the user approves a specific keyword, note, or profile read, so it is an active fetch rather than a monitored queue.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill clones an executable package from the beatra-ai GitHub repository and installs it for execution, and it reads a remote skill-route response that selects the network hosts it uses; the commit and tree pins are enforced, but the publisher identity rests on self-declared metadata that conflicts with the entry's own "source: community" label, so this is treated as common/reputable unofficial and rated medium.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). Decisive operation: the skill's paid tool calls (cover rendering, and optional paid social-data lookups) consume prepaid Beatra credits through a token carrying wallet:spend scope, with billing ledgers and balance holds. I treated this as a direct debit of a prepaid wallet, not a plain service-cost exclusion, because the skill itself spends from the wallet on the user's approved instructions (recall-first). Direct operation, so the control test applies. Control evidence: every tool call goes to the service's hosted endpoint, and verify, tools, upload, and call require a working bearer token issued by Beatra's OAuth device flow. Without that token, the client does not proceed, so service authentication gates the paid route. Agent-followed cost-card approval and balance refusals are not counted as controls. This establishes qualifying access control, so the severity is medium rather than high. The service-cost reading would give "no," but the recall-first override favors the higher tier.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.40). The skill has the agent copy an external package into the agent's skills directory (~/.claude/skills), run an OAuth flow that stores a full-scope bearer token with spend rights under ~/.beatra, and send device telemetry. None of it needs sudo, touches system files, or creates user accounts, and the install is pinned, hash-verified, and gated behind explicit approvals, so it is user-scoped rather than a clear system compromise, but the credential and config changes warrant a moderate flag.