BOM用量与损耗差异核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 6:03 AM UTC
• Version: 1.0.12

Overview

The skill appears to run a local BOM checker, but it mixes that checker with under-disclosed payment and upsell instructions and has confusing free-versus-paid scope claims.

Review this before installing. The local checker itself looks bounded, but do not rely on it for paid-only checks such as 串料 detection, and do not let the skill or an agent complete payment or installation steps unless you independently trust the merchant and links.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The description explicitly includes '串料' as a trigger/use case, while later sections say '串料检测' is not included in the free version. This inconsistency is dangerous because users may believe cross-order material misallocation is covered when it is not, producing incorrect operational or audit decisions.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The skill states the free version executes seven checks, but elsewhere says some notable checks are excluded from the free version. Contradictory scope statements can cause agents or users to rely on security or audit conclusions that were never actually performed, leading to false assurance and missed anomalies.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看内置样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看内置样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看内置样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The primary user-facing metadata and descriptions are presented in Chinese, and the usage/instructional content is overwhelmingly Chinese without stating that users may choose their preferred language. This can violate language/locale policy when a skill implicitly requires one language rather than offering opt-in or choice.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest and summary frame this as a free, local-only checker that only runs engine-declared free checks, but the body of the skill adds mandatory upsell and purchase-routing behavior. This mismatch can mislead agents, users, and policy enforcement into permitting behaviors outside the declared scope, including commercial redirection and checkout initiation.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The description claims 'no network', yet the skill instructs the agent to direct users to online purchase pages and potentially complete a checkout/install flow. False claims about network behavior undermine trust and can bypass user or platform expectations around offline/local-only operation.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: A BOM variance checker should analyze worksheets, not require the agent to market products, present purchase paths, or facilitate checkout and fulfillment. Embedding sales workflow into an analysis skill expands the trust boundary and creates opportunities for unwanted solicitation, phishing-like link delivery, or policy-violating monetization flows.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The file’s user-facing documentation, field labels, sample input, advice text, and result notes are written entirely in Chinese, and the accepted headers are also Chinese-specific. There is no natural-language indication that users may choose another language or locale, which can amount to a language/locale policy violation when no opt-in is provided.

Description-Behavior Mismatch

Low

• Confidence: 88% confidence
• Finding: The manifest and file header emphasize that the free skill performs only local BOM consumption variance checks and does not go beyond the declared free checks. While the code does not make a network request, it does emit an external purchase-page URL, which is behavior outside the stated checking purpose and introduces promotional functionality not described in the manifest.

Context-Inappropriate Capability

Low

• Confidence: 90% confidence
• Finding: A skill whose stated purpose is to recompute and verify BOM/work-order consumption discrepancies does not need to expose a commercial purchase link to fulfill that purpose. This is a separate capability—marketing or upsell messaging—rather than an obvious implementation detail of local variance analysis.

Static analysis

No suspicious patterns detected.