Security audit

银行流水对账核对（免费版）

Security checks for vulnerabilities and agentic risk

Overview

The reconciliation tool itself is local and purpose-aligned, but it embeds an optional paid-upgrade flow that asks agents to run an unpinned external installer and it adds upsell text to normal output.

Review this before installing if you do not want skills to include payment prompts. The free reconciliation function appears local and bounded, but do not copy or execute the paid-upgrade prompt unless you intentionally want to install payment tooling and a separate paid skill; verify the package source and version first.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger list contains broad terms such as '对账', '银行对账', and similar generic accounting phrases, which can cause the skill to activate in contexts broader than intended. Over-triggering is dangerous here because the skill also contains embedded upsell/purchase and tool-use guidance, increasing the chance that unrelated conversations are steered into this skill's workflow.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The skill embeds instructions directing the agent to run `npx -y @alipay/agent-payment@latest install`, which fetches and executes remote code without a pinned version. Because the skill content is adversarial input and this path is tied to payment/install onboarding, an attacker or compromised upstream package could cause arbitrary code execution or unauthorized workflow manipulation on the host.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The file-level documentation and user-facing instructional text are written exclusively in Chinese, and the sample inputs/outputs also assume Chinese labels such as "银行" and "账面". This creates a locale-specific constraint without offering users a language choice or clearly documenting a justified region-specific policy scope.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The user-facing natural-language content, including the title, usage help, status messages, and instructions, is entirely in Chinese. There is no indication that the user can opt into another language or that the Chinese-only constraint is documented as a justified region-specific limitation.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill advertises that no payment is required for normal use, but the CLI appends purchase and upsell messaging directly into standard output after producing results. In agent or pipeline contexts that consume stdout as trusted task output, this can mislead users, contaminate downstream parsing, or create deceptive pressure to buy despite the 'free' claim.

Intent-Code Divergence

Low

Confidence: 83% confidence
Finding: The function comment says non-JSON input is treated as plain-text material and even gives '直接粘贴的合同全文' as an example, which contradicts the skill's documented purpose of reconciling bank statements and book records. This suggests a broader document-ingestion intent than the actual declared banking-reconciliation scope.

Static analysis

No suspicious patterns detected.