Receipt Expense Sorter

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 6:56 AM UTC
• Version: 1.0.0

Overview

This is a local receipt and expense organization skill with disclosed file input and optional report output, and no evidence of network access, persistence, exfiltration, or destructive behavior.

Installers should treat this as a local draft/report generator for receipt and reimbursement materials. Only provide files intended for expense organization, review generated reports before using them in any finance process, and be aware that the output file path may be created or overwritten when --output is used.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 声明描述的是一个面向财务收据和报销材料整理的工具，应侧重按周期、类别、凭证完整度分组以及缺失提醒。但实际代码没有任何收据、报销、财务凭证、周期分类、类别识别或缺失项校验的专门逻辑。相反，代码通过 spec 驱动多种通用模式：structured_brief、directory_audit、csv_audit、pattern_audit、skill_audit，可扫描目录、统计文件扩展名、读取 CSV 字段、匹配潜在危险命令或密钥样式、检查 Skill 工程文件完整性与 frontmatter。其主要目的明显是通用审计/报告生成，而不是财务报销资料整理。因此描述与实际行为存在明显且重大的不一致。

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code implements source-text security pattern scanning across arbitrary files and directories, which is unrelated to receipt sorting and gives the skill broad repository inspection capability. In this skill context, that makes the mismatch more dangerous because users may grant access expecting finance document organization, while the code can enumerate and inspect other local content including secret-like strings and internal URLs.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill_audit functionality checks arbitrary repository structure, parses SKILL.md frontmatter, and reports on project internals unrelated to expense processing. This broad local auditing behavior is risky in context because it enables inspection of developer repositories or agent skills under a misleading finance-oriented label, undermining informed consent and least-privilege expectations.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script’s primary dispatch logic supports generic report generation over arbitrary files, directories, CSVs, pattern scans, and skill audits rather than a narrowly scoped receipt/expense workflow. This capability mismatch is dangerous because it expands the skill into a general-purpose local inspection tool, increasing the chance of unintended data access and abuse beyond the declared finance-ops use case.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger examples are broad natural-language phrases that can overlap with ordinary finance-related requests, increasing the chance the skill is invoked when the user did not explicitly intend to use it. In a receipts/expense workflow this is not inherently destructive, but accidental activation can still expose sensitive financial materials to unnecessary processing or produce misleading draft outputs in the wrong context.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares executable capabilities and file I/O behavior in its instructions, including a python3 shell invocation and use of local files, but does not declare any explicit tool scope such as allowed-tools or permissions. This creates an authorization and review gap: an agent or runtime may permit broader access than users expect, making unintended file reads, writes, or shell execution harder to govern and audit.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This markdown file presents all headings and instructional text exclusively in Chinese, which can amount to a language/locale policy violation when no user opt-in or alternative language support is indicated. The file does not state that the skill is region-specific or that Chinese output is optional, so it appears to force a specific language by default.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The template is entirely written in Chinese and provides no indication that output language should follow the user's preference or locale. In practice, this can cause the skill to ignore user language expectations, leading to confusing or inaccessible outputs, especially in multilingual finance workflows where accuracy and user confirmation matter.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The generated report strings are written in Chinese (for example, headings and guidance text), which forces a specific language regardless of user preference. This is a natural-language locale policy concern because the file does not offer opt-in, selection, or justification for restricting output to Chinese.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The CLI describes itself as a generic 'local support script,' which obscures the true breadth of accepted inputs and weakens user understanding of what the tool may inspect. While not exploit code by itself, misleading interface documentation contributes to unsafe operation by making overbroad file access appear routine and aligned with the declared receipt-processing purpose.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: 全文仅以中文定义技能名称、说明、触发示例和使用方式，呈现出默认且唯一的中文交互约束，但没有声明这是面向特定中文场景的区域性技能，也没有提供语言选择或用户 opt-in。根据 SQP-3，这类自然语言层面的单一语言强制可能构成语言/locale 政策问题。

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The description forces a bilingual presentation in Chinese and English but does not state that language should be selected based on user preference. Under the language/locale policy check, this is a natural-language policy issue because no opt-in or choice mechanism is documented.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The title, labels, summary, examples, and risk text are all written in Chinese, which can impose a language expectation on users without any stated opt-in or region-specific justification. Under the language/locale policy rule, natural-language content that forces a specific language without user choice should be flagged.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: This code creates parent directories and writes the rendered report to the user-supplied output path, which is a filesystem-modifying operation. Although it logs after writing, there is no prior warning, confirmation, or inline disclosure near the write path itself about creating directories and overwriting file contents.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: This markdown file presents all user-facing test instructions in Chinese, and there is no indication that the user can choose another language or that the language constraint is justified. Under the language/locale policy rule, forcing a specific language without opt-in can be a natural-language policy violation.

Static analysis

No suspicious patterns detected.