Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看样例
Security audit
收入与成本截止性核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
This is a local Chinese-language accounting cutoff-check skill that reads user-supplied working-paper text and produces deterministic findings without network use or persistence.
Install only if you are comfortable using a Chinese-language local tool for audit or month-end cutoff working papers. Review results as advisory checks, not audit opinions, and be aware that duplicate-document findings may be repeated because the duplicate check runs twice.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看样例
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The manifest says the trigger phrases include “截止性测试底稿对不上,” which is a natural-language complaint rather than a narrowly scoped command. Without negative examples or clearer invocation boundaries, this could overlap with ordinary discussion of document mismatches and cause unintended activation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s user-facing documentation, sample inputs, status advice, and finding messages are written in Chinese throughout. There is no indication that users may choose another language or that the skill is limited to a China-specific compliance context, so this appears to force a specific language without user opt-in.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The header comments and checklist describe a bounded set of free checks with each check executed as declared. In the main flow,
checkDuplicate(items)is invoked on both L306 and L307, so the same capability is applied twice and duplicate findings are emitted, which contradicts the documented intent of a cleanly scoped free-check implementation.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The user-facing docstrings, usage text, errors, and status messages are entirely in Chinese, which imposes a specific language/locale on all users. The file does not indicate that Chinese is optional, user-selectable, or justified as a region-specific tool, so this is a natural-language policy concern under the language-choice rule.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The JSON payload consists entirely of Chinese headers and descriptions, indicating the skill/template is fixed to a specific language/locale. For all file types, this can be a natural-language policy concern when no user opt-in or justification for the locale restriction is provided.
- Content