Security audit

审计与账务调整技能包（免费版）

Security checks for vulnerabilities and agentic risk

Overview

This is a local audit-workpaper checker that reads user-supplied files, runs disclosed checks, and does not show hidden network, persistence, or file-writing behavior.

Install only if you are comfortable processing audit and accounting workpapers locally through this skill. Point --input only at the intended exported text directory or file, and remember that results may print sensitive source-file names, line numbers, and finding details to the terminal or agent transcript.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (36)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 整体上，代码的大部分核心行为与描述是高度一致的：它确实本地运行、无联网、批量处理多个被审计单位、调用 14 个子检查引擎、返回带原文文件与行号的核对结果。因此如果只看免费基础核对能力，描述基本准确。但按“描述是否准确代表代码实际行为”的标准，仍存在实质性不一致：该代码并不只是‘每单位一行结论’的简单工具，而是一个带免费档/完整档分层的批量编排器，输出包含对象级结果、全局 findings、summary、scope、未执行项、超出范围说明等 richer 结构；更重要的是，代码文本明确把‘完整档’的跨单位汇总台账、风险排序、共性问题归类、Markdown/CSV 导出定义为该技能包的扩展能力，并预留 ledger_hook 挂载点。即使此代码片段默认 ledger_hook 为空，这些额外能力已被代码公开宣示为同一技能包的实际产品行为边界。因此，声明对基础用途是大体正确的，但没有准确覆盖代码所体现的分层产品能力与更宽的输出行为，构成描述-行为不完全匹配，判断为 mismatch。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 该描述明显高估了代码能力。代码文件名称、注释、常量和主入口逻辑都表明它只是“预提费用与到票冲销核对”模块，而且还是“免费档子集”。实际执行的检查仅有6项：期末勾稽、期末为负、计提/冲销为负、合计复核、重复项目、空白占位符；另有5项检查被放入 CHECKS_WITHHELD 并明确说明未执行。声明则称会对14类审计/账务调整事项逐单位核查，这在范围和主目的上都严重不符。此外，run() 只接收 payload.text 中的一张表，解析项目行并返回 findings/summary，并没有“每个被审计单位一行结论”的单位维度汇总能力；结果中虽含 line，但无原文文件定位。唯一与声明一致的是本地运行且 network_used=false、不需API Key。但整体主功能与覆盖范围存在重大描述-行为不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 代码中的文件名、service_type、注释与实现都表明其核心功能是“ASSET_DISPOSAL_CHECK/固定资产处置损益核对”。它解析包含资产名称、原值、累计折旧、账面净值、处置收入、清理费用、处置损益的表格，执行账面净值复算、处置损益复算、累计折旧超过原值、合计行复核、重复资产、空白字段等检查，并返回findings。代码还显式声明这是“免费档子集”，CHECKS_WITHHELD只是未执行检查项说明，进一步说明能力范围受限。虽然“本地运行、无网络”与声明一致，但主功能范围与声明严重不符：声明是一个覆盖14项底稿审计的综合技能，代码却只是其中一个子检查器，因此属于明显的描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 该代码的主功能与声明存在明显范围收缩和目的偏差。声明描述的是一个覆盖14类审计/账务调整事项的综合核对工具，面向多个被审计单位输出单位级结论；而实际代码仅处理“资产减值测试表”这一专项检查，且只执行6项基础规则。文件顶部和返回结果都明确说明有未执行检查项（CHECKS_WITHHELD），进一步表明它不是完整实现。此外，代码不解析原始文件，也不维护文件级定位信息，只记录输入文本中的行号，因此无法满足“结论都带原文文件与行号”的声明。另一方面，“完全本地运行、不联网、无需API Key”与代码行为是一致的，但这不足以抵消核心能力与范围上的重大不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 存在明显描述-行为不一致。代码的核心功能边界写得很清楚：这是“audit-adjustment-check.js —— 审计调整分录核对（免费档；完整档实现不在本包）”，只做算术与字符串核对，不判断会计处理正确性，也不联网。它要求输入为一张带表头的文本表格，并仅执行 6 类检查：借贷差额复算、科目净影响复算、合计行复核、重复行、空白/占位符、负数金额。相比之下，声明描述的是一个更广泛的底稿核对器，覆盖 14 个不同审计/账务调整主题，并按被审计单位输出总结结论且带原文文件与行号。实际代码既没有实现这 14 个主题的大部分，也没有“逐单位一行”这种输出结构，更没有文件读取/原文引用能力。唯一一致之处是“本地运行、不联网、无需 API Key”。因此应判定为实质性不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 描述与代码行为存在明显重大不一致。代码确实符合“本地运行、无联网”这部分声明，但核心能力严重缩水：它不是对14项审计检查的总核对器，而只是一个针对坏账准备计提表的局部检查模块。代码中CHECKS_GIVEN仅有6个坏账准备相关校验，CHECKS_WITHHELD还说明同领域内另有5项未执行；更没有实现其他如试算平衡、固定资产折旧、存货跌价准备、现金盘点、罚款违约金结算等检查。输出形式也与声明不符：结果是findings列表和汇总，而非“每个被审计单位一行结论”。因此应判定为描述与实际行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 代码行为与声明的核心用途存在明显不一致。声明描述的是一个覆盖 14 个审计/账务调整检查项的综合核对工具，而该代码块仅是 cash-count-check 子模块，专门核对现金盘点长短款，且只接受文本表格输入。它确实符合“本地运行、不联网、无需 API Key”的部分描述，但主能力范围被大幅缩窄：既没有实现试算平衡、审计调整分录、折旧摊销、减值、预提、存货跌价等其他检查，也没有生成按被审计单位汇总的一行式结论。代码中还明确声明这是“免费档子集”，部分检查项仅列为 withheld/not_run 说明。因此应判定为描述与实际行为存在实质性不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 该描述与代码行为存在明显且实质性的范围不一致。描述承诺的是一个覆盖14项审计/账务调整检查的完整本地核对工具，并以“逐单位一行结论”形式输出；但提供的代码仅针对固定资产折旧台账做有限的确定性算术核对，属于14项中的单一子项，而且连折旧子项内部也只执行部分检查，其他检查被明确列为 withheld/not run。代码不联网、无需API Key这一点与声明一致，但这只是运行属性一致，不能弥补核心功能范围和输出形式上的重大偏差。因此应判定为描述与实际行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 该代码与声明在“本地运行、不联网、不需要 API Key”方面是一致的；代码也确实是纯 Node 标准库、无网络访问。但核心能力存在明显不符。声明描述的是一个面向审计与账务调整底稿的 14 项综合核查工具，范围涵盖试算平衡、审计调整分录、资产减值、资产处置、固定资产折旧、无形资产摊销、模具摊销、坏账准备、预提费用、预付款核销、长期待摊、存货跌价、现金盘点、罚款违约金等，并按“每个被审计单位一行结论”输出。实际代码仅是单一模块 intangible-amortization-check.js，只针对无形资产摊销台账进行校验，而且还在注释和返回结构中明确说明这只是“免费档子集”，多项更深层检查（如研发资本化衔接、已达到可使用状态未摊销等）未执行。因此其主要目的和覆盖范围都远小于声明，属于实质性描述不符。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 代码注释和实现都表明这是 inventory-provision-check.js，仅针对“存货跌价准备核对”。其主入口 run() 只解析包含‘期间、存货名称、存货成本、可变现净值、应计提跌价准备、期初准备余额、本期计提、本期转回或结转、期末准备余额’的文本表，并执行 6 个免费检查项。代码还明确声明“完整档（付费）的实现不在这个包里”，并列出 5 个未执行检查项。因此，它的实际能力远小于声明中的 14 项全面审计检查。虽然“完全本地运行、不联网、无需 API Key”这一点与声明一致，但核心功能范围与输出形态存在重大不一致，属于明显描述-行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 该描述与代码存在明显功能性不一致。代码没有表现出未声明的高风险额外能力，且‘本地运行、不联网’这一点与声明一致；但主功能范围被严重夸大。声明承诺的是一个覆盖14项审计检查的完整工具，并按每个被审计单位形成带文件与行号依据的结论。实际代码仅是一个单文件、本地运行的“长期待摊费用摊销核对”模块，只做表内数值勾稽，且还是免费档子集，明确有若干相关检查项未执行。它既不处理其余13类检查，也不读取文件、提取原文出处，亦不按单位生成结论。因此应判定为描述与实际行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 该代码与描述存在明显的能力范围不一致。描述承诺的是一个覆盖 14 个审计检查项的完整本地核对工具，面向多个被审计单位输出综合结论，并附带原文文件与行号。实际代码却只是一个单独模块 mold-amortization-check.js，专门检查模具/工装摊销表的内部计算关系，而且只执行 6 项“免费档”检查，另有 5 项明确标为 withheld 未执行。它既没有实现其余 13 大类检查，也没有实现“逐单位一行结论”或“原文文件定位”能力。唯一与描述一致的是本地运行、无网络请求这一点。但核心功能范围和主要用途被大幅夸大，因此应判定为描述与实际行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 该描述与代码存在明显能力范围不一致。描述宣称的是一个覆盖14项审计检查的完整本地核对工具，面向多个被审计单位，输出单位级结论并附文件与行号。实际代码却是单独目录下的 penalty-settlement-check，从注释到实现都聚焦“罚款与违约金”这一项台账检查；而且还是“免费档子集”，仅运行6类基础规则，并把多项更完整能力列为 CHECKS_WITHHELD/checks_not_run。代码没有实现其余13个审计主题，也没有按单位聚合生成一行式结论，只是对输入表格逐行产出问题项和合计摘要。资源使用方面倒是与“本地运行、不联网、无API Key”基本一致，但核心功能范围被大幅高估，因此应判定为描述与实际行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 该描述宣称的是一个覆盖 14 个审计/账务调整主题的综合核对工具，范围包括试算平衡、审计调整分录、减值、处置损益、折旧摊销、坏账、预提、存货跌价、现金盘点、罚款违约金等，并按被审计单位输出结论。实际代码文件却只围绕“预付款与预付账款核销”台账展开，且源码注释明确说明这是“免费档子集”，完整档实现不在包里。代码执行的检查仅限期末余额勾稽、未到票不得冲销、负余额、合计复核、重复合同、空白占位符等，与声明中的大部分能力无关或缺失。虽然“本地运行、无网络请求”这一点与声明一致，但核心用途和覆盖范围明显缩窄，属于实质性描述与行为不符。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 该代码与声明在“是否本地运行、是否联网”方面是一致的：代码只用本地 Node.js 逻辑，未见网络访问，也不需要 API Key。但核心功能存在明显不符。代码文件名、注释和实现都表明它只是 trial-balance-check，且还是“免费档子集”，仅执行 7 项试算平衡相关检查，另外还有 3 项完整档检查被明确标注为 withheld，更不用说声明中列出的 14 类审计/账务调整核对项目。代码也没有按“单位”分组汇总、没有文件来源管理，只是对一份文本表格做检查并返回 findings。因此这不是轻微范围差异，而是声明将一个狭窄的试算平衡检查器描述成了覆盖 14 项底稿审计的综合技能，属于实质性描述-行为不匹配。
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.
md
node scripts/run.mjs --sample # 单单位样例（内置）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
md
node scripts/run.mjs --sample # 单单位样例（内置）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.
md
node scripts/run.mjs --sample # 单单位样例（内置）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.
md
node scripts/run.mjs --sample # 单单位样例（内置）

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest describes this skill as the free package that locally checks 14 audit items and outputs one conclusion per audited entity. However, the file header explicitly says it is shared source with a full/paid edition, and later code exposes withheld premium capability descriptions and a ledger hook integration point, which goes beyond the manifest's claimed scope for this specific skill package.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file’s natural-language instructions, interface contract descriptions, sample data, and user-facing disclaimers are written entirely in Chinese and describe fixed Chinese-language headings such as === 检查项 ===. There is no indication that users may choose another language or locale, so the skill appears to impose a specific language by default.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The comments claim this free-package file does not implement the full paid features and that CHECKS_WITHHELD is merely descriptive. But later the module defines and invokes ledger_hook(result, findings, rows, payload), with comments stating the full edition replaces it with real cross-object ledger behavior, so the documentation is not strictly consistent with the executable structure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This JavaScript file contains its descriptive comments, sample data, error messages, notes, and disclaimer entirely in Chinese, and there is no indication that users may opt into another language or locale. Under the natural-language policy rule, forcing a specific language without user choice is a policy concern unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file’s natural-language comments, user-facing advice, error messages, and result strings are entirely in Chinese, indicating the skill is designed to interact in a single language by default. There is no visible mechanism offering the user a language choice or documenting that the locale restriction is optional or justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file’s user-facing comments, messages, labels, sample input, and outputs are entirely in Chinese, and there is no indication that users may select another language or that the skill is intentionally restricted to a Chinese-only regulatory region. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.