ClawHub
Back to skill

Security audit

门诊收费与退费日结核对（免费版）

Security checks for vulnerabilities and agentic risk

Overview

The local checker itself is simple, but the skill also pushes users toward external paid purchase and installation flows despite advertising no payment and no network use.

Install only if you are comfortable with a free local checker that also prompts for an optional paid upgrade. Do not allow the agent to follow purchase links, fetch product IDs, install skillpay-onboarding, install dependencies, or install the paid skill unless you deliberately requested that and have independently verified the merchant, product, amount, and platform rules.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The file claims the tool is fully local and does not use the network, yet later sections instruct the agent to visit external websites, follow purchase links, and use mutable endpoints. This contradiction is dangerous because it can mislead users, reviewers, and automated policy systems into trusting a skill as offline/safe when it actually contains network-dependent behavior and remote redirection paths.

Ae1

High
Category
analysis-evasion
Content
node scripts/run.mjs --sample # 先看样例
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
node scripts/run.mjs --sample # 先看样例
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The skill is presented as a local, no-network reconciliation tool, but it also embeds instructions for agents to initiate external purchase and installation flows, including visiting multiple URLs and retrieving updated product identifiers. This expands the agent’s behavior far beyond the stated accounting task and creates a supply-chain and social-engineering risk, because an agent following the document may fetch remote content, expose users to payment flows, and install additional components based on untrusted or mutable external resources.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The documentation instructs the agent to handle purchasing, onboarding, and installation steps that are unrelated to daily cashier reconciliation. Granting a business-ops checking skill e-commerce and software acquisition behavior violates least privilege and increases the chance of unauthorized purchases, remote dependency installation, or user coercion into payment flows that the user did not clearly request.

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
This markdown file contains user-facing descriptions and operational instructions primarily in Chinese, including the main display name, summary, trigger wording, and usage guidance. Although there is a brief English description field, the skill as a whole does not offer a clear language choice or require user opt-in before defaulting to Chinese, which can violate language/locale policy requirements.

Whitespace Padding

Medium
Category
Prompt Injection
Content
输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。
Confidence
80% confidence
Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The user-facing description, usage text, errors, and output strings are entirely in Chinese, which imposes a specific language/locale on all users. The file does not indicate that Chinese is optional, user-selected, or justified as a region-specific constraint.

Description-Behavior Mismatch

Low
Confidence
94% confidence
Finding
The script advertises a third-party/official purchase URL during normal execution even though the skill is presented as a local, free verification tool. This can mislead users into leaving the local workflow, creates an unnecessary trust boundary crossing, and opens a path for phishing, upsell pressure, or future behavior drift if that URL changes or is compromised.

Static analysis

No suspicious patterns detected.