工程产值与进度确认核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 6:14 AM UTC
• Version: 1.0.39

Overview

The checker code is local, but the skill also tells agents to promote and execute an external paid purchase/install flow, which is broader than the advertised no-payment, no-network checker.

Install only if you are comfortable with a skill that includes a paid upgrade path and agent-directed external installation instructions. The free checker itself appears local and self-contained, but you should disable or ignore upsell behavior if unwanted, avoid letting an agent initiate purchases or install external skills automatically, and independently verify any SkillPay URLs, merchant IDs, product IDs, package names, and amounts before proceeding.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill advertises itself as a fully local, no-network checker, yet later embeds instructions for external purchase and installation flows via third-party links and payment infrastructure. This mismatch can mislead users and host agents into trusting the skill's boundary claims, increasing the risk of unauthorized navigation, external transactions, or dependency installation beyond the stated purpose.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The documentation explicitly claims '完全本地运行' and '不联网', but later directs use of online resources and purchase endpoints. False locality/no-network claims are dangerous because they can lower operator suspicion and cause systems to grant trust they would not otherwise grant to a skill that invokes external web resources.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: A document-checking skill should not contain embedded instructions to discover products, initiate purchases, install dependencies, and follow external onboarding flows. Expanding capability from passive checking into commerce and installation creates an opportunity for social engineering, policy bypass, and supply-chain exposure if an agent follows these instructions automatically.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The description says "触发词包括" and lists only two example phrases, which suggests a non-exhaustive trigger set rather than a precise activation rule. One listed phrase, "工程产值与进度确认表对不上", is relatively broad natural wording that could match many ordinary troubleshooting requests about a document being inconsistent, and the file provides no negative examples or explicit scope constraints.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs the agent to open third-party links, install external dependencies, and participate in payment-related flows, but does not provide a single clear end-user warning summarizing the risks of external transactions and supply-chain installation. In context, this omission makes social engineering easier and reduces informed consent for sensitive actions.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file’s user-facing natural-language documentation and messages are entirely in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking/regional context. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.

Intent-Code Divergence

Low

• Confidence: 92% confidence
• Finding: The inline documentation explicitly says non-JSON input may be handled as '直接粘贴的合同全文', which broadens the documented input intent beyond the stated skill purpose of checking 工程产值与进度确认表. The implementation does indeed accept arbitrary plaintext and pass it to the engine, so the comment diverges from the skill's narrowly stated form-checking intent.

Static analysis

No suspicious patterns detected.