建筑工人工资专户发放核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 6:14 AM UTC
• Version: 1.0.39

Overview

The checker code is local, but the skill also pushes users toward a mutable external paid purchase and installation flow despite offline/no-network claims.

Install only if you are comfortable with a Chinese-language wage-checking tool that runs locally for the free checks but also contains a built-in paid-upgrade workflow. Do not let the agent follow purchase links, dynamic redirects, or install the paid skill unless you deliberately choose that flow and separately verify the merchant, product, amount, and newly installed skill.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The manifest and description represent the skill as fully local, offline, and requiring no network access, but the file also embeds instructions for external purchase and installation flows. This discrepancy can mislead users, policy engines, or host platforms into granting trust or tool permissions under false assumptions, creating a channel for unexpected network interaction and supply-chain exposure.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: Claiming 'completely local' and 'not联网' while later directing the agent to external purchase endpoints is a trust-boundary violation. Even if optional, these instructions undermine the safety claim and may cause an agent to perform remote actions that operators and users did not expect from an offline audit tool.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The documentation creates a false assurance that the skill is fully local and offline while also embedding directions for networked websites and installation flows. This inconsistency weakens user trust, can mislead governance controls, and makes it easier to smuggle external-action behavior into a tool expected to be deterministic and self-contained.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill contains mandatory upsell and purchase orchestration behavior unrelated to its core wage-checking purpose. Embedding transactional instructions in an analysis skill increases prompt-surface area for social engineering, can pressure agents to deviate from user intent, and may trigger unsafe external actions.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The instructions in this section prescribe exact user-facing messaging and purchase-flow wording entirely in Chinese, and the skill overall is presented as mandatory agent behavior without any language or locale opt-in. Although the domain is China-specific, the file does not explicitly state that the skill is restricted to Chinese-speaking users or offer an alternative language path for those interactions.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The file instructs the agent to fetch external purchase information and follow redirectable links, which is unnecessary for the free checking function and introduces phishing, link-swapping, and supply-chain risks. Redirect-based acquisition is especially dangerous because the target can change without updating the skill file, defeating static review.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This JavaScript file’s natural-language interface, instructions, errors, and disclaimers are entirely in Chinese, including user-facing return messages later in the file. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation unless the constraint is explicitly documented and justified as region-specific.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The returned disclaimer states that the tool checks payroll-table consistency against special-account payout totals, but the free version explicitly withholds that check and only computes totals without comparing them. This can mislead users into trusting a control that was never executed, creating a security-relevant integrity gap in a wage-compliance workflow where operators may skip manual verification based on the false claim.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The JSON value consists entirely of Chinese field names and sample data, which indicates a locale-specific output format baked into the skill template. For a general-purpose skill artifact, this imposes a specific language/locale without offering opt-in or documenting that the skill is region-specific.

Description-Behavior Mismatch

Low

• Confidence: 62% confidence
• Finding: The manifest promises "每条结论引用原文", implying conclusions should directly cite source text. The code generates narrative findings from parsed numeric fields and row identifiers, but does not preserve or attach original row text snippets as evidence; conclusions are reconstructed from normalized values instead of explicitly quoting the original text.

Intent-Code Divergence

Low

• Confidence: 85% confidence
• Finding: L077 的注释写明“例如直接粘贴的合同全文”，但该脚本其余说明与 manifest 都限定输入应为“建筑工人工资专户发放核对表（含表头）”。这会让开发者误以为合同全文也是本技能的预期处理对象，与代码和技能意图存在文档层面的偏差。

Static analysis

No suspicious patterns detected.