Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看样例
Security audit
门诊收费与退费日结核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local, deterministic checker for clinic cashier daily reconciliation tables, with no evidence of network use, persistence, credential access, or hidden behavior.
Install only if you are comfortable running a local Node.js script on clinic reconciliation data. The skill appears to keep processing local and does not request registration, payment, API keys, credentials, or network access, but its interface and output are primarily Chinese and it only performs the free subset of checks it lists.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看样例
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill’s comments, prompts, error messages, findings, and disclaimers are all hard-coded in Chinese, and there is no indication that users can select another language or that the skill is restricted to a Chinese-only deployment context. This can violate a language/locale policy where user-facing skills must not force a specific language without opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The user-facing description, usage text, errors, and output are all hardcoded in Chinese throughout the file. This creates a language/locale restriction without any opt-in or alternative, which matches the policy-violation category for forced language selection.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The comment says non-JSON input is treated as plain-text material such as a pasted '合同全文', which describes a different document type from the skill's stated purpose of checking outpatient cashier daily reconciliation tables. The implementation and surrounding usage/help text consistently target 门诊收费与退费日结核对表 input, so this inline documentation is actively misleading about intended input scope.
- Content