Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
在产品与完工产品成本分配核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
The free checker itself runs locally, but the skill also tells agents to guide users through external payment and installation for a paid version.
Install only if you are comfortable with a Chinese-language local checker that also promotes a paid version. Treat any payment link, QR code, external install instruction, merchant ID, product ID, and new skill installation as a separate transaction that requires deliberate review; the free checker can be used without paying.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Context-Inappropriate Capability
High
- Confidence
- 97% confidence
- Finding
- Embedding commerce and installation orchestration inside a cost-allocation checking skill is context-inappropriate and expands the agent's authority beyond the stated purpose. Because the content instructs the agent to follow external purchase/install flows, it can be abused for deceptive upsell, phishing redirection, or unauthorized supply-chain changes under the guise of a simple local accounting tool.
Context-Inappropriate Capability
High
- Confidence
- 98% confidence
- Finding
- The skill explicitly requires the agent to provide payment links or QR codes and complete post-payment installation steps. This is dangerous because it normalizes transactional prompts inside a non-commerce skill, increasing the risk of social engineering, payment fraud, and installation of additional components based on documentation content rather than trusted platform controls.
Natural-Language Policy Violations
Medium
- Confidence
- 93% confidence
- Finding
- The manifest-facing fields such as display name, summary, tags, and primary description are presented only in Chinese, and the markdown body likewise instructs users in Chinese. While an English description exists on L013, the skill does not state that Chinese is optional, user-selectable, or required for a region-specific compliance purpose, which can amount to forcing a specific language without opt-in.
Description-Behavior Mismatch
Medium
- Confidence
- 95% confidence
- Finding
- The skill presents itself as a free, fully local accounting checker, but embeds instructions that steer the agent into facilitating purchase and installation of a separate paid product. This creates a trust-boundary violation: a user invoking a local verification tool may be unexpectedly exposed to transactional flows, external links, and installation actions unrelated to the core analysis task.
Natural-Language Policy Violations
Medium
- Confidence
- 95% confidence
- Finding
- The natural-language comments and user-facing advisory text are entirely in Chinese, including guidance returned to users such as the advice in the insufficient-input response. For a generally applicable skill, this effectively imposes a specific language/locale without offering a user choice or documenting a justified region-specific constraint.
Natural-Language Policy Violations
Medium
- Confidence
- 93% confidence
- Finding
- The file’s user-facing documentation, usage text, errors, and output strings are entirely in Chinese, presenting the skill as operating in that language by default. There is no indication that users may choose another language or that the Chinese-only behavior is a necessary region-specific constraint, which matches the language/locale policy violation criteria.
Natural-Language Policy Violations
Medium
- Confidence
- 93% confidence
- Finding
- The JSON payload consists entirely of Chinese-language headers and values, indicating a fixed language/locale expectation. There is no natural-language indication that the user can choose another language or that the skill is intentionally limited to a Chinese-specific context.
Intent-Code Divergence
Low
- Confidence
- 93% confidence
- Finding
- The comment says non-JSON input is treated as plain-text material such as a pasted '合同全文', which suggests broader document handling than this skill's stated purpose of checking cost allocation tables. Elsewhere in the same file, the manifest-facing help consistently says the input must be a cost allocation table with headers, so the inline documentation is misleading about intended input scope.
Static analysis
No suspicious patterns detected.