Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看样例
Security audit
应收账款坏账准备计提核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local Chinese-language accounting table checker, and I found no hidden networking, credential access, persistence, or destructive behavior.
Install this only if you are comfortable running a local Node script over accounting table data you provide. The tool appears narrowly scoped and offline, but its interface is Chinese-first and Bash permission should still be treated as permission to run the packaged command locally.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看样例
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
L11-L12 将触发词写为“应收账款坏账准备计提核对、坏账准备计提表对不上”。其中“坏账准备计提表对不上”属于较自然的日常表述，且未说明需要哪些上下文、输入材料或排除场景，容易与一般性的求助表达重叠，触发范围边界不够清晰。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file’s natural-language comments, user-facing advice, findings, notes, and disclaimer are all written in Chinese, and there is no indication that the user can choose another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s docstring, usage text, errors, and normal output are entirely in Chinese, and there is no option for the user to select another language or any stated justification that this tool is region- or locale-specific for compliance reasons. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
文件整体展示与主要说明默认采用中文，且技能名称在 L03 使用中文作为主要展示名，但未在说明中告知用户可选择其他语言输出。虽然存在英文字段，但未见面向用户的语言选择机制或明确的用户同意流程。
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill claims the packaged engine runs fully locally with no network, yet the manifest allows Bash execution without any visible constraints enforcing that claim. If the runner or scripts invoked through Bash perform network access, fetch dependencies, or exfiltrate local data, users may be misled into granting trust based on inaccurate documentation.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
Lines L55-L63 state that the free version does not include specific checks and that the only difference from the full product is that listed set. However, L36 says the actual executed checks come from engine
CHECKS_*exports and--sampleoutput, and this file provides no code-level guarantee that the exclusions are enforced. This creates a mild manifest-to-behavior mismatch risk because the advertised scope restriction is not substantiated here.- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
L075 的注释写明“不是 JSON 就当作纯文本材料（例如直接粘贴的合同全文）”，这与文件顶部及清单帮助中反复声明的用途——仅针对坏账准备计提表（含表头）做核对——形成主动性文档偏差。代码本身后续仍交给专用引擎处理，但这条注释会误导开发者认为任意合同全文都属于该技能的支持范围。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The JSON value on L2 consists entirely of Chinese headers and content, which indicates a language-specific output format. For all file types, policy findings apply when a skill forces a specific language or locale without user opt-in or documented justification.
- Content