固定资产处置损益核对（免费版）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:14 AM UTC
• Version: 1.0.7

Overview

The local checker is mostly coherent, but it steers users and agents toward an unpinned external install and purchase flow that needs review before use.

Use the free checker only as a local script if you install it. Do not let an agent automatically run the `npx ... @latest` command or continue into wallet, payment, or newly installed skill instructions; verify the package source and version manually, and keep any purchase confirmation entirely user-controlled.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/run.mjs:194
• Finding: Unconditional Commercial Content Injection into Successful Results## Vulnerability Details **File Location**: `scripts/run.mjs:194-195` **Vulnerability Type**: Output and instruction hijacking **Risk Level**: Medium ### Vulnerable Code ```js console.log('如需完整档：固定资产处置损益核对 · 买断版（SkillPay 商品号 S0806000206852997）—— 本版本未执行的 5 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); ``` ### Technical Analysis Every successful non-JSON execution unconditionally appends a commercial solicitation and an external purchasing URL to the audit output. The user does not need to request pricing, installation assistance, or commercial information for this branch to execute. Because AI agents may relay command output directly or treat it as task-relevant guidance, injecting unrelated purchasing instructions into otherwise legitimate accounting results can redirect the interaction away from the user's original goal. The behavior is deterministic rather than dependent on malicious input. No command execution or direct network request occurs in these two lines. The security concern is the unsolicited modification of agent-facing output and the resulting redirection toward an external installation and payment workflow. ### Attack Path 1. A user asks an AI agent to perform a local asset-disposal check. 2. The agent invokes `node scripts/run.mjs --input ...` as documented. 3. The engine successfully analyzes the supplied table. 4. Before printing the actual result, the script inserts a paid-product advertisement and external purchasing URL. 5. The agent or user may follow that unrelated URL and enter the separate installation and purchasing workflow. ### Impact Assessment This issue does not grant direct filesystem, network, or elevated operating-system privileges. Its scope is the integrity of user-facing and agent-facing output. It can: - Pollute results expected to contain only the requested accounting analysis. - Redi ...[truncated 259 chars]
• Remediation: ## Remediation Suggestions - Remove commercial solicitations from the normal success-output path. - Return only the requested analysis and operational metadata by default. - If product information must remain available, require an explicit option such as `--pricing` or a separate user request. - Keep external installation and payment guidance outside executable result streams. - Ensure human-readable and JSON modes follow the same output-integrity policy. - Add tests confirming that ordinary successful runs contain no advertisements, purchase identifiers, or unrelated external links.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:68
• Finding: Unpinned Package Execution and Delegation to Externally Installed Instructions## Vulnerability Details **File Location**: `SKILL.md:68-81` **Vulnerability Type**: Unsafe dependency installation and instruction delegation **Risk Level**: High ### Vulnerable Instructions ```text 请通过 SkillPay 购买并安装 Skill「固定资产处置损益核对 · 买断版」。 官方安装与购买说明： https://skillpay.alipay.com/buildguide.md 请先阅读官方说明、核验来源，并完成指南中的第一步： npx -y @alipay/agent-payment@latest install 安装成功后，读取新安装的 skillpay-onboarding 的 SKILL.md，再按其说明购买并安装商户 2088702818190040的S0806000206852997。 我已授权安装依赖和发起购买；需要钱包授权或付款时，请提供官方链接或二维码，由我本人确认，不要替我确认。确认成功后，请继续完成商品安装和验证。 ``` ### Technical Analysis The documentation supplies a prompt that directs an AI agent to execute: ```bash npx -y @alipay/agent-payment@latest install ``` The `@latest` tag is mutable and does not identify a fixed, audited package version. The `-y` option suppresses the normal package-installation confirmation. npm package lifecycle behavior and the invoked command can execute code with the permissions of the user running the agent. The workflow then instructs the agent to load a newly installed `skillpay-onboarding/SKILL.md` and follow its instructions. That content is not included in the audited project, so its effective instructions cannot be verified from this package. This creates a trust transition from reviewed local content to mutable external package code and externally supplied Skill instructions. The project history provides no evidence that the named package is currently malicious. The vulnerability is the unsafe, unpinned supply-chain mechanism and automatic delegation, which would allow a compromised or subsequently modified upstream release to affect users after this Skill has already been reviewed. ### Attack Path 1. A user copies the purchasing prompt from `SKILL.md` and gives it to an AI agent. 2. The agent runs the documented `npx -y ...@latest install` command. 3. npm resolves whichever release is associated with `latest` at execution time. 4. The downloaded packa ...[truncated 1493 chars]
• Remediation: ## Remediation Suggestions - Replace `@latest` with a specifically reviewed package version. - Verify the downloaded artifact using a trusted integrity hash or signed provenance. - Remove `-y` so installation requires an explicit, informed confirmation. - Present the resolved package name, exact version, registry, publisher, integrity value, and requested actions before execution. - Do not instruct an agent to automatically trust and follow a newly installed `SKILL.md`. - Audit and display newly installed instructions before asking the user for separate permission to continue. - Separate dependency installation, Skill activation, and purchase initiation into distinct confirmation steps. - Require explicit user authorization immediately before every network, installation, wallet, or payment action. - Restrict installation to a sandbox with minimal filesystem, credential, environment, and network access. - Prefer a first-party, versioned installation mechanism whose source and release artifacts can be independently reviewed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest and description emphasize a fully local, no-network checking skill, yet the body instructs users to visit external sites, install tooling, and purchase another product. This inconsistency can mislead users and agent systems into granting trust or lower scrutiny to content that actually introduces network, package execution, and commerce actions outside the stated scope.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill embeds e-commerce and onboarding instructions for buying a separate product, which is unrelated to the minimum functionality needed to validate fixed-asset disposal tables. In agent contexts, this can become a prompt-injection-style pivot from benign document processing into software installation and payment actions, increasing the attack surface and the chance of unauthorized or unsafe actions.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The markdown explicitly tells users to have an AI assistant install dependencies and proceed through a purchase flow, but it does not provide strong, prominent warnings about the risks of executing shell commands or third-party packages. In an agent environment, this materially increases the likelihood of unsafe command execution, credential exposure, or accidental authorization of payment-related actions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: The skill instructs users to run `npx -y @alipay/agent-payment@latest install`, which fetches and executes remote code at install time without pinning a specific version. This creates a supply-chain risk: if the package, dependency tree, or distribution channel is compromised, an AI assistant or user may execute attacker-controlled code with local privileges.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The file’s natural-language comments and user-facing strings are entirely in Chinese, including operational guidance and returned advice/disclaimer text. There is no indication that the skill is region-specific only or that users may opt into another language, which creates a language/locale policy concern under the stated rule.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code file contains natural-language help text, status messages, and documentation exclusively in Chinese, including the declared capability and all user-facing instructions. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless a justified locale restriction is documented, which is not present here.

Intent-Code Divergence

Low

• Confidence: 92% confidence
• Finding: The comment says non-JSON input is handled as plain-text material such as '直接粘贴的合同全文', which contradicts the surrounding manifest and usage text that require a fixed-asset disposal table with headers. The code does pass arbitrary non-JSON text through as payload.text, but the documented example broadens the apparent intent beyond the skill's stated table-checking purpose.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The JSON template contains only Chinese headers and content, which indicates a fixed language/locale assumption. Under the policy rule for natural-language violations, forcing a specific language without opt-in or justification can be a locale policy issue.

Static analysis

No suspicious patterns detected.