预提费用与待摊费用摊销核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 9:24 AM UTC
• Version: 1.0.6

Overview

The bundled checker is local and simple, but the skill also tells agents to upsell and run an external paid purchase/install flow despite claiming no payment or network use.

Install only if you want a Chinese-language local checker and are comfortable ignoring or disabling the upsell path. Do not let the agent fetch remote purchase instructions, install skillpay-onboarding, or generate payment links unless you explicitly intend to buy the separate paid skill and verify the merchant, amount, and platform rules yourself.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The manifest explicitly claims 'no network,' yet the body includes external URLs and instructions requiring access to remote sites for purchase and installation flows. This contradiction undermines trust boundaries and can trick users or agents into allowing network access they would otherwise deny, increasing the risk of exfiltration, phishing, or unreviewed remote content ingestion.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is presented as a local, free accounting-check tool, but it embeds instructions for the agent to fetch external documentation, purchase another product, and continue installation steps for a separate paid skill. That creates a hidden capability expansion from offline analysis into transaction orchestration and external dependency installation, which can be used for phishing, unauthorized purchases, or supply-chain abuse.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill contains mandatory upsell instructions directing the agent to advertise paid options on every invocation and, if selected, to carry out a purchase workflow and return payment links. Those instructions are unrelated to the core accounting-validation function and create social-engineering pressure plus transaction handling behavior inside a business-analysis skill, expanding risk far beyond its stated purpose.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The manifest and body are predominantly written in Chinese, including required user-facing prompts and operational instructions, and there is no statement that users may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The file’s natural-language comments, sample text, labels, advice, and user-facing result messages are all written in Chinese, with no indication that language is configurable or limited to a China-specific deployment context. This can violate language/locale policy when users are not given an opt-in choice or the locale restriction is not explicitly justified.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This file contains help text, status messages, and usage instructions only in Chinese, which effectively forces a specific language for users. Under the policy, language constraints should either be optional for the user or explicitly documented as justified for a specific locale or region.

Intent-Code Divergence

Low

• Confidence: 91% confidence
• Finding: The inline documentation states that non-JSON input may be treated as '直接粘贴的合同全文', which contradicts the rest of the file and manifest that consistently describe the expected material as an accrued/prepaid expense detail table with headers. The code itself wraps arbitrary non-JSON content as plain text and passes it to the engine, so the comment broadens the apparent intent beyond the declared table-checking purpose.

Static analysis

No suspicious patterns detected.