银行贷款利息与还款计划核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 3:19 PM UTC
• Version: 1.0.39

Overview

The checker code appears local and purpose-aligned, but the skill also embeds agent-directed upsell steps that can lead to external payment and skill installation despite no-payment and no-network claims.

Review this skill before installing. The local checker appears to run offline, but do not let an agent follow the paid upgrade, payment-link, raw-IP, or external installation instructions unless you explicitly intend to buy and install another skill through those services.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill advertises itself as fully local, offline, and requiring no network access, but later instructs the agent to perform external purchase and installation flows via multiple URLs. This creates a trust-boundary violation: users and host systems may permit the skill under the assumption it is offline-only, while the documentation embeds behavior that can trigger network access, software installation, and payment-related actions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The embedded upsell and payment-handling instructions are unrelated to the skill's primary purpose of checking loan-interest and repayment schedules. Because the instructions direct the agent to obtain links, process purchase steps, and install additional components, the skill expands from deterministic document checking into commerce and dependency-acquisition behavior, increasing phishing, abuse, and policy-bypass risk.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Although the text mentions purchase and installation, it does not prominently and unambiguously disclose that following the steps may install external dependencies and initiate a real financial transaction. The presence of direct links, a fixed IP-based URL, and step-by-step agent instructions can cause an automated assistant or user to treat the flow as routine continuation rather than a sensitive boundary crossing.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file’s user-facing natural-language instructions, warnings, result messages, and disclaimers are entirely in Chinese, with no indication that another language can be selected. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The user-facing description, usage text, prompts, and output strings are entirely in Chinese, indicating the skill is designed to operate in a single language. The file does not offer any language/locale selection or state that the tool is intentionally limited to a Chinese-speaking or region-specific context, which can violate language/locale policy requirements.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The only natural-language content in this file is a fully Chinese tabular template, which implies the skill output or expected content is fixed to Chinese. For a non-region-specific template, this can violate language/locale policy because it does not offer the user any language choice or document a justified locale constraint.

Intent-Code Divergence

Low

• Confidence: 83% confidence
• Finding: The inline comment says non-JSON input may be '直接粘贴的合同全文', which broadens the documented input type to full contract text. Elsewhere in the file, usage/help text and insufficiency guidance repeatedly state the required material is a 银行贷款利息与还款计划核对表 with headers, so this comment contradicts the actual intended input semantics rather than merely omitting detail.

Static analysis

No suspicious patterns detected.