Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
寄售代销结算核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
This is a local consignment-settlement checking skill that reads a user-supplied ledger and reports calculation issues without network use, persistence, or credential handling.
Install only if you are comfortable running a local Node-based checker on consignment settlement ledger text. Treat it as a free-tier arithmetic and consistency checker: it does not perform the listed full-tier checks such as sold-but-unsettled detection or contract-rate overcharge detection, and it does not provide legal, tax, invoice, or contract advice.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Description-Behavior Mismatch
Medium
- Confidence
- 95% confidence
- Finding
- The top-level description says this skill performs a broad set of settlement checks, including issues such as '已销未结' and '手续费多扣' in its trigger phrases, while the later free-version section explicitly states that checks like 已销未结检测 and 手续费率高于合同约定检测 are not included. This creates a semantic mismatch between what the skill claims in its manifest and what the file says the free version actually does.
Intent-Code Divergence
Medium
- Confidence
- 87% confidence
- Finding
- Lines L78-L86 state the free version does not include several checks and that 'the difference is exactly the above items, nothing else.' However, earlier documentation presents broader checking behavior and trigger coverage that overlaps with excluded items, creating an active contradiction inside the file about intended capability. This is more than incomplete documentation because the file affirmatively claims both inclusion and exclusion of related checks.
Natural-Language Policy Violations
Medium
- Confidence
- 96% confidence
- Finding
- The file’s user-facing natural-language comments and guidance are entirely in Chinese, including operational warnings and usage descriptions. Under the stated policy, forcing a specific language without user opt-in or documented locale-specific justification is a natural-language policy violation.
Natural-Language Policy Violations
Medium
- Confidence
- 95% confidence
- Finding
- The user-facing docstring, usage text, errors, and output messages are entirely in Chinese, with no indication that the skill is region-specific or that other languages are supported on request. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Intent-Code Divergence
Medium
- Confidence
- 88% confidence
- Finding
- The usage text states that the tool has a '完整档' with five additional checks and outputs a recovery-handling list, but this runner loads `engine/consignment-settlement-check.js` and labels itself as the free tier. The inline comment at L166 also refers to a paid switch, yet no such switch is set here, so the documentation implies capabilities this file does not perform.
Static analysis
No suspicious patterns detected.