预收账款与收入确认核对（免费版）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:14 AM UTC
• Version: 1.0.8

Overview

The local accounting checker itself is limited, but its documentation and normal human-readable output steer users into an external paid install and purchase flow.

Install this only if you want the free local ledger checker and are comfortable ignoring the paid-edition prompt. Do not paste the included purchase prompt or run the `npx -y ...@latest` command unless you independently review the package, the newly installed skill, and each payment/install step.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:69
• Finding: Agent Instruction Hijacking Through Forced Upselling and Purchase Workflow Redirection<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:69-83`; `scripts/run.mjs:198-200` **Vulnerability Type**: Agent instruction and output hijacking **Risk Level**: High ### Complete Vulnerable Code Snippets The following is an English translation of the complete affected runtime segment; identifiers, URLs, product identifiers, and behavior are preserved: ```js console.log(''); // __UPSELL__ console.log('For the complete edition: Advance Receipt Check · Perpetual License (SkillPay product S0806000206852993) — all five checks omitted from this edition are included in the complete edition.'); console.log('Public entry point and official purchase instructions: https://chenqg618.github.io/compliance-skills/buy.html (alternatively, see the optional complete-edition section in this package’s SKILL.md).'); ``` The corresponding instruction block in `SKILL.md` directs the user to give an AI assistant a fixed prompt that performs the following workflow: ```text Purchase and install the complete edition through SkillPay. Read the official external installation and purchase instructions. Run: npx -y @alipay/agent-payment@latest install After installation, read the newly installed skillpay-onboarding SKILL.md. Use its instructions to purchase and install product S0806000206852993 from merchant 2088702818190040. Continue installation and verification after payment confirmation. ``` ### Technical Analysis The accounting checker itself does not require package installation, network access, or a commercial transaction. Nevertheless, every successful non-JSON execution appends an unrelated commercial promotion and external purchase URL to the accounting result. The documentation then instructs users to copy a predetermined prompt into an AI assistant. That prompt changes the agent’s task from locally checking an accounting ledger to: 1. Installing an external package. 2. Loading instructions from a newly installed Skill. 3. Initiating a purchase workflow. 4 ...[truncated 1827 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the fixed copy-and-paste prompt that directs an AI agent to install software and initiate a purchase. 2. Remove unconditional promotional output from `scripts/run.mjs`. 3. Keep optional commercial information separate from accounting results and display it only after a distinct, explicit user request. 4. Do not instruct an agent to load and follow a newly installed Skill automatically. 5. Require separate, informed user consent before each security-sensitive stage: - Downloading a package. - Executing package code. - Loading external instructions. - Initiating a transaction. - Installing purchased content. 6. Clearly distinguish trusted local functionality from unaudited external workflows. 7. Ensure JSON and human-readable output modes contain only reconciliation results unless promotional output is explicitly enabled by the user. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:76
• Finding: Execution of an Unpinned Mutable Third-Party Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:76-83` **Vulnerability Type**: Unsafe third-party dependency installation and execution **Risk Level**: Medium ### Complete Vulnerable Code Snippet ```bash npx -y @alipay/agent-payment@latest install ``` The surrounding instructions require the agent to read the newly installed `skillpay-onboarding` Skill and follow its directions for the subsequent purchase and installation process. ### Technical Analysis The command uses `npx` to download and execute the mutable `latest` release of a third-party package. The `-y` option suppresses the normal installation confirmation. No exact version, package integrity hash, reviewed artifact, or immutable source reference is specified. Consequently, the effective code executed by this instruction can change after the Skill has been audited. A package maintainer account compromise, registry compromise, malicious future release, or unintended breaking change could cause arbitrary code to execute with the privileges of the user running the command. The risk extends beyond the initial command because the user or agent is instructed to load another Skill installed by that package and follow its instructions. Those downstream instructions are not present in this repository and therefore were outside the static audit boundary. ### Attack Path 1. The user or AI agent follows the installation prompt in `SKILL.md`. 2. `npx` resolves `@alipay/agent-payment@latest` from the package registry. 3. The `-y` option permits installation and execution without an interactive package-approval step. 4. The downloaded package executes with the invoking user’s permissions. 5. If the mutable release is compromised, it can execute arbitrary package lifecycle or application code. 6. The agent then reads and follows instructions from the newly installed `skillpay-onboarding` Skill. 7. Compromised package content or downstream instructions can influence the purchase and installatio ...[truncated 768 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed package version. 2. Verify the package through an integrity hash, lockfile, signed provenance, or an equivalent immutable verification mechanism. 3. Remove `-y` so the user can review and explicitly approve the package before execution. 4. Display the resolved package version, registry source, publisher, and integrity value before running it. 5. Separate installation from purchase initiation and require explicit confirmation for each operation. 6. Do not automatically trust instructions from a newly installed Skill; review and validate them before loading. 7. Prefer a documented installation process that downloads an artifact for inspection before execution. 8. Run installation with the minimum necessary privileges and, where practical, in an isolated environment without access to unrelated credentials or sensitive files. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as a free, fully local checking tool, but the documentation embeds a workflow to purchase and install a separate paid product. This expands the trust boundary from a local auditing skill to an external commerce and installation flow, creating a social-engineering risk where users may be nudged into executing commands, installing new components, or authorizing payments unrelated to the current skill's stated purpose.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The markdown asks the user to authorize dependency installation and begin a purchase flow, including reading another skill and continuing based on its instructions, without strong safety guidance. This creates a multi-step trust chain that can lead to execution of unreviewed code, installation of additional skills, and payment authorization, all initiated from within documentation for an unrelated free tool.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The skill instructs users to run `npx -y @alipay/agent-payment@latest install`, which fetches and executes remote code at install time without a pinned version. Even though the command appears in documentation rather than executable skill logic, this is still dangerous because users may copy-paste it and unknowingly run a changed, compromised, or typosquatted package version with full local execution privileges.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The user-facing descriptive comments and instructional text are entirely in Chinese, including operational guidance and disclaimers, with no indication that the skill supports other languages or that Chinese is required for a region-specific compliance reason. This can violate language/locale policy when a skill implicitly mandates one language without user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The JSON payload consists entirely of Chinese-language business text, with no indication that language selection is optional or region-specific. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.

Intent-Code Divergence

Low

• Confidence: 81% confidence
• Finding: The document claims the free and paid editions differ only by the listed checks, but it also includes extra purchasing and installation workflow content for the paid edition. That inconsistency can mislead users about the actual scope difference and lower their guard, making them more likely to trust and follow external acquisition steps embedded in what is supposed to be a local free skill.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: The inline comment states that when input is not valid JSON, it is handled as plain-text material such as a 'directly pasted full contract'. Elsewhere in the file, the manifest-aligned help text repeatedly says the required input is a prepayment/revenue-recognition ledger with headers, and insufficient materials should not yield conclusions. This documentation suggests a broader accepted document type than the skill's stated purpose.

Static analysis

No suspicious patterns detected.