Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看样例
Security audit
资产减值测试核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local Chinese-language accounting checker that reads a user-provided asset impairment table and runs bounded arithmetic checks without network use or persistence.
Install only if you work with Chinese-language asset impairment test tables and are comfortable running a local Node script on copied table data. The free version intentionally omits several advanced checks, so do not treat a clean result as a full accounting or audit opinion.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看样例
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file’s natural-language comments, sample data, user-facing advice, findings, notes, and disclaimer are all written in Chinese, and the tool expects Chinese column headers such as '资产编号' and '账面价值'. There is no indication that users may choose another language or locale, which can violate a language/locale policy requiring opt-in or choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file’s user-facing description, usage text, errors, and results are written entirely in Chinese, indicating the skill is intended to operate only in that language. There is no visible opt-in, alternative locale, or documented justification for restricting language, which can violate the language/locale policy for natural-language behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The JSON content is entirely in Chinese and provides no indication that language selection is optional or constrained by a documented region-specific purpose. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.
- Content