广告代理返点与框架返点核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 5:39 AM UTC
• Version: 1.0.30

Overview

The local rebate checker itself looks bounded, but the skill instructions push users into agent-led payment and installation flows that go beyond the advertised free local tool.

Use this only if you want the free local rebate-table checks. Before installing, be aware that the skill also tells the agent to present a paid upgrade path and, with user selection, initiate purchase and installation steps; do not approve payment links, QR codes, or new skill installs unless you have independently verified the merchant, product, amount, and source.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The skill explicitly claims it runs entirely locally and does not use the network, yet the same document later requires use of external URLs, purchase endpoints, and online installation guidance. False claims about isolation materially increase risk because users, auditors, or policy engines may grant trust they would not otherwise grant.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is presented as a free, local, no-network rebate checking tool, but later instructs the agent to initiate external purchase and installation flows via payment URLs and web pages. This mismatch can mislead users and downstream agents about the trust boundary, causing unexpected network access, payment orchestration, and interaction with third-party services unrelated to the core checking task.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The documented behavior expands from invoice/rebate verification into commerce orchestration, including directing the agent to purchase another product, fetch payment links, and complete installation steps. That creates an unnecessary high-risk capability path where a business-ops checking skill can induce financial actions and external dependency changes beyond user expectations.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The instructions to the agent are written as mandatory behavior and all required user-facing disclosure text is defined only in Chinese, with no indication that the user may choose another language. This creates a language/locale policy concern because the skill effectively mandates a specific language for required interaction without opt-in or a clearly documented region-specific justification.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Ssd 4

Medium

• Confidence: 90% confidence
• Finding: The skill directs the agent to install another skill and proceed through a purchase workflow using user-granted authorization, which introduces permission and supply-chain expansion beyond the original task. This progressive escalation is dangerous because it normalizes sensitive actions after initial trust has been established and can expose users to unauthorized or poorly understood changes in their environment.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This code file’s user-facing natural-language descriptions, warnings, and result text are written exclusively in Chinese, with no indication that users may choose another language or locale. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The user-facing description, usage text, prompts, and errors are entirely in Chinese, and the file does not indicate that language choice is optional or that the tool is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without opt-in is a natural-language locale violation.

Ssd 4

Low

• Confidence: 83% confidence
• Finding: The mandated 'deliver value first, then require a one-time upsell disclosure' is a trust-building narrative pattern that conditions users to accept later commercial prompts after receiving helpful output. In isolation this is lower severity, but in this skill it compounds the broader issue of steering from a local checking task into payment and installation behavior.

Intent-Code Divergence

Low

• Confidence: 90% confidence
• Finding: The comment says non-JSON input is treated as plain-text material such as a directly pasted '合同全文', implying broader document support. However, the rest of the file repeatedly requires an '广告代理返点与框架返点核对表（含表头）' and reports insufficient input when recognizable table structure is missing, so the comment overstates supported input intent.

Static analysis

No suspicious patterns detected.