Security audit

银行承兑汇票台账与到期兑付核对（免费版）

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to run locally without network or persistence, but it gives conflicting statements about which financial checks are actually run.

Install only if you are comfortable using a local Chinese-language financial checker whose advertised scope is inconsistent. Do not rely on its output as proof that omitted checks were truly omitted or completed; manually verify the maturity-date scope and any financial conclusions before using them operationally.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 先看样例
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 先看样例
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: L05/L11 明确宣称免费版会做“到期日复算/到期日 = 出票日 + 期限月数”的逐票核对；但 L59-L67 又写明本版本“不包含”‘到期日与期限月数不符检测’和相关到期日判断。这不是单纯信息缺失，而是同一技能文档对免费版实际执行范围给出互相冲突的行为描述，用户会被误导其实际会检查什么。

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The header comment states that the free file only implements free checks and that CHECKS_WITHHELD is merely descriptive text, not implementation. But the code defines checkMaturity() and executes it in run(), while CHECKS_WITHHELD includes the same maturity mismatch detection. This is an active contradiction between documentation and behavior.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The manifest describes the free skill as checking due date recalculation, balance reconciliation, duplicate bill numbers, missing status, non-positive amounts/terms, and settled bills still counted in balance. However, the file's own CHECKS_WITHHELD list explicitly says '到期日与期限月数不符检测' is a withheld, unexecuted check, while run() actually invokes checkMaturity(). This is a semantic mismatch between declared executed scope and actual behavior.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The user-facing description, usage, help text, and runtime messages are entirely in Chinese, with no indication that another language is supported or that the user can opt in to this locale. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation.

Static analysis

No suspicious patterns detected.