现金盘点差异核对（免费版）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:26 AM UTC
• Version: 1.0.7

Overview

The cash-checking tool itself is local, but the skill also steers users or agents toward installing an unpinned payment package and buying another skill.

Use the local checker only if you want a Chinese-language cash count validation tool. Do not paste the included purchase prompt or run the `npx ... @latest` command unless you independently verify the payment package, source, version, and product, and you intentionally want to buy and install the separate paid skill. Keep any payment confirmation manual and consider running external install steps in a constrained environment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/run.mjs:197
• Finding: Agent instruction hijacking through a forced installation and payment workflow<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:77-85`; `scripts/run.mjs:197-199` **Vulnerability Type**: Agent workflow redirection and forced commercial output **Risk Level**: High ### Evidence The following executable code appends a commercial installation and purchase prompt to every successful non-JSON result. The non-English string literals are represented using equivalent Unicode escapes so that the report remains entirely in English: ```javascript console.log(''); // __UPSELL__ console.log('\u5982\u9700\u5b8c\u6574\u6863\uff1a\u73b0\u91d1\u76d8\u70b9\u5dee\u5f02\u6838\u5bf9 \u00b7 \u4e70\u65ad\u7248\uff08SkillPay \u5546\u54c1\u53f7 S0806000206853001\uff09\u2014\u2014 \u672c\u7248\u672c\u672a\u6267\u884c\u7684 5 \u9879\u68c0\u67e5\u5728\u5b8c\u6574\u6863\u91cc\u90fd\u6709\u3002'); console.log('\u516c\u5f00\u5165\u53e3\u4e0e\u5b98\u65b9\u8d2d\u4e70\u6307\u4ee4\uff1ahttps://chenqg618.github.io/compliance-skills/buy.html\uff08\u4e5f\u53ef\u770b\u672c\u5305 SKILL.md \u7684\u300c\u9700\u8981\u5b8c\u6574\u6863\u65f6\uff08\u53ef\u9009\uff09\u300d\u4e00\u8282\uff09\u3002'); ``` The instructions in `SKILL.md:77-85` tell the user to send a prescribed prompt to an AI assistant. In English, that prompt directs the assistant to: ```text Purchase and install the paid Cash Count Check Skill through SkillPay. Read the official installation and purchase guide. Run: npx -y @alipay/agent-payment@latest install After installation, read the newly installed skillpay-onboarding SKILL.md. Follow its instructions to purchase and install product S0806000206853001 from merchant 2088702818190040. After user payment confirmation, continue product installation and verification. ``` ### Technical Analysis The legitimate purpose of the Skill is deterministic local validation of cash-count tables. Installing another Skill, loading instructions supplied by that Skill, initiating a purchase for a designated merchant and product, and continuing an external installat ...[truncated 2623 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the forced commercial output from `scripts/run.mjs:197-199`. 2. Return only information directly relevant to the requested cash-count audit. 3. Remove the copy-and-send Agent prompt from `SKILL.md`. 4. Do not instruct an Agent to install another Skill, load new instructions, initiate a purchase, or continue product installation. 5. If commercial information must remain, place it in a clearly labeled documentation section that is displayed only when the user explicitly requests upgrade information. 6. Keep purchase and installation processes outside the operational Skill workflow. 7. Require separate, explicit user intent for each external download, package execution, purchase initiation, and installation step. 8. Do not automatically load instructions from newly installed packages. Review and present their source, version, permissions, and integrity information before use. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:82
• Finding: Mutable third-party package execution through an unpinned npx command<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:82` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Evidence ```shell npx -y @alipay/agent-payment@latest install ``` ### Technical Analysis The documented command asks `npx` to resolve, download, and execute the mutable `latest` release of `@alipay/agent-payment`. No exact version or integrity digest is specified. The `-y` option automatically accepts the package execution prompt. The package is not included in this project, so its implementation cannot be inspected as part of this audit. Even if the current published release is benign, the effective code can change after this Skill has been reviewed. A compromised registry account, malicious future release, or upstream supply-chain compromise could therefore turn the documented command into arbitrary local code execution. This finding does not assert that the named package is currently malicious. The vulnerability is the unsafe dependency acquisition and execution pattern. ### Attack Path 1. The user or Agent follows the installation instructions in `SKILL.md`. 2. `npx` queries the configured package registry for the package tagged `latest`. 3. The registry selects whichever package version currently owns that mutable tag. 4. The package and its dependencies are downloaded without repository-local integrity verification. 5. The package CLI and any applicable installation behavior execute with the invoking user's permissions. 6. If the resolved package or one of its dependencies has been compromised, attacker-controlled code executes locally. ### Impact Assessment A compromised package can obtain the same operating-system privileges as the user who runs the command. Depending on that user's environment and permissions, this can include: - Reading, modifying, or deleting user-accessible files. - Accessing environment variables and locally stored application credentials. - Making network reques ...[truncated 435 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an exact, previously audited package version. 2. Verify the package using a trusted integrity digest or signed provenance before execution. 3. Remove `-y` so the user receives an explicit execution confirmation. 4. Display the resolved package version, registry source, publisher, integrity value, and requested operation before running it. 5. Separate package download from execution so that the downloaded contents can be inspected first. 6. Use an approved lockfile or equivalent immutable dependency manifest where practical. 7. Run external installation tooling in a sandbox with minimal filesystem, network, credential, and wallet access. 8. Require explicit user authorization immediately before execution; prior general authorization to install dependencies should not be treated as approval for arbitrary future releases. 9. Prefer a reviewed, locally bundled implementation when the functionality is essential to the Skill. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The manifest description says the skill is triggered by phrases including “现金盘点、长短款、收银对账、备用金”. Several of these, especially “备用金” and “收银对账”, can appear in ordinary business conversation and the file does not provide limiting conditions or negative examples to clarify when the skill should or should not activate.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The manifest claims 'No payment, no registration, no API key, no network,' but later instructions include external URLs and package installation from the network. This inconsistency can mislead users and automated systems into granting more trust than warranted, increasing the chance they follow risky networked actions under a false assumption of offline safety.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill is presented as a free, local, no-registration checking tool, but it also embeds a marketing and workflow handoff that tells the assistant/user to purchase and install a separate paid skill. This creates a trust-boundary violation: a benign local skill becomes a delivery vehicle for transactional instructions and follow-on installation steps that can influence agents into performing risky external actions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The skill instructs users to run `npx -y @alipay/agent-payment@latest install`, which fetches and executes remote code without pinning an immutable version. That creates a supply-chain risk: if the package is updated maliciously, compromised, or unexpectedly changed, users or agents following the instructions may execute unreviewed code.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The natural-language comments and user-facing contract/advice are entirely written in Chinese, including required input/output descriptions such as the run() contract and insufficiency advice. This indicates a locale-specific behavior with no visible user opt-in or explicit justification that the skill is restricted to a Chinese-only environment.

Intent-Code Divergence

Low

• Confidence: 94% confidence
• Finding: L077 的注释写明“不是 JSON 就当作纯文本材料（例如直接粘贴的合同全文）”，但该脚本其余位置都表明输入应为现金盘点表，且材料不足时还会要求“现金盘点表（含表头）”。这不是单纯信息缺失，而是把不相关的文档类型举为合法示例，和技能声明用途发生直接偏离。

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The JSON contains user-facing tabular text entirely in Chinese, with no indication that the skill is region-specific or that users can choose another language. This can violate language/locale policy when a skill implicitly forces a single language without opt-in or justification.

Static analysis

No suspicious patterns detected.