ClawHub
Back to skill

Security audit

农产品收购发票与进项抵扣核对（免费版）

Security checks for vulnerabilities and agentic risk

Overview

The checker code is local, but the skill text instructs agents to offer and carry out external paid upgrade and installation flows despite local/no-network claims.

Install only if you are comfortable with a skill that is locally runnable for the free checks but also instructs the agent to present a paid upgrade and potentially navigate external payment/install flows. Do not let the agent follow purchase links, redirects, QR codes, or install extra components unless you explicitly initiated that action and verified the merchant, product, amount, and platform rules yourself.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The documentation states 'fully local' and 'no network,' but other sections require accessing external URLs and purchase endpoints. This contradiction is dangerous because users and automated systems may grant trust based on the local-only claim while the skill actually encourages remote interactions that can affect privacy, integrity, and user funds.

Ae1

High
Category
analysis-evasion
Content
node scripts/run.mjs --sample # 先看样例
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
node scripts/run.mjs --sample # 先看样例
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The skill claims to be a fully local, no-network invoice-checking tool, but later instructs the agent to access external purchase, installation, and product-update URLs. This creates a trust-boundary violation: an agent invoked for local financial reconciliation may unexpectedly perform network-driven commerce and installation actions, exposing users to phishing, supply-chain, and unauthorized workflow risks.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
Embedding payment and installation flows inside a tax/invoice reconciliation skill is unrelated to the stated business purpose and can manipulate the agent into performing sensitive actions outside the user's expected task. Even if framed as optional upsell, it increases the attack surface by combining document analysis with software acquisition and payment orchestration.

Whitespace Padding

Medium
Category
Prompt Injection
Content
输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。
Confidence
80% confidence
Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill includes external purchase/install links, JSON endpoints, and redirect-based URLs without a clear security disclosure about the risks of contacting third-party services, following redirects, or installing additional components. In a finance-adjacent workflow, this can mislead users or agents into exposing environment details or consuming untrusted remote content.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
This code hardcodes user-facing advice in Chinese, and the rest of the skill's prompts, findings, and disclaimer text are likewise Chinese-only. For a general-purpose skill file, this imposes a specific language/locale without user opt-in, which matches the policy-violation category.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The user-facing capability name, help text, usage guidance, and runtime messages are entirely in Chinese, which imposes a specific language/locale on users. The file does not indicate that Chinese is optional, user-selected, or justified as a documented region-specific constraint.

Static analysis

No suspicious patterns detected.