建筑企业月度自查包（免费版）

• Outcome: Pass
• Latest audit: Sep 20, 2026 · 1:02 PM UTC
• Version: 1.0.52

Overview

This skill is a local Chinese-language construction finance checker that reads user-provided text and shows no network, credential, persistence, or data-changing behavior.

Use this only for Chinese-language construction finance self-checks, and treat outputs as arithmetic/reconciliation assistance rather than accounting, legal, audit, or tax advice. Provide only the materials needed for the check, and review the listed checks not run before relying on a clean result.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: This finding likewise identifies a serious claims-vs-behavior inconsistency, here suggesting only the production/progress-confirmation logic exists while the other two advertised categories do not. Even if the exact missing category differs across static findings, the core security-relevant issue is the same: overstated assurance in a financial review skill can conceal unreviewed risk areas and produce false operator confidence.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: This finding likewise identifies a serious claims-vs-behavior inconsistency, here suggesting only the production/progress-confirmation logic exists while the other two advertised categories do not. Even if the exact missing category differs across static findings, the core security-relevant issue is the same: overstated assurance in a financial review skill can conceal unreviewed risk areas and produce false operator confidence.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: This finding likewise identifies a serious claims-vs-behavior inconsistency, here suggesting only the production/progress-confirmation logic exists while the other two advertised categories do not. Even if the exact missing category differs across static findings, the core security-relevant issue is the same: overstated assurance in a financial review skill can conceal unreviewed risk areas and produce false operator confidence.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The manifest text says the skill is triggered by phrases including “月底核对”, “月度自查”, and especially “对不上怎么办”. These are generic phrases that could appear in normal accounting or project discussions without intending to invoke this specific skill, and no exclusion conditions or narrowing context are provided.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file-level comments and all user-facing guidance are written exclusively in Chinese, including input instructions and behavioral disclaimers. Because the skill does not offer a language choice or explicitly justify that it is limited to a Chinese-only regional workflow, this appears to impose a specific language/locale without user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The natural-language guidance, labels, messages, and disclaimers in the file are written entirely in Chinese, and there is no indication that the skill offers a language choice or that it is intentionally restricted to a Chinese-speaking or region-specific context. Per the policy, forcing a specific language without opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The file’s natural-language description, labels, advice strings, and required input headers are entirely in Chinese, and the contract in L017-L018 gives no indication that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The file’s natural-language instructions, messages, and user-facing guidance are written exclusively in Chinese, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The user-facing natural-language content, including the title, usage, help text, status messages, and error descriptions, is entirely in Chinese. There is no indication that the skill is region-specific or that users can choose another language, which can violate language/locale policy requirements for opt-in or documented justification.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: The user-facing summary and descriptions are written entirely in Chinese and describe invocation phrases only in Chinese, while the English description is minimal and does not indicate equivalent English usage. This may violate a language-choice policy if users are expected to be able to opt into another language or locale.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The JSON value at L2 is entirely in Chinese, including section headings and field labels, which imposes a specific language/locale on users. Under the policy, locale-specific language is only acceptable when the skill offers user choice or clearly documents and justifies the constraint, neither of which appears in this file.

Static analysis

No suspicious patterns detected.