收入与成本截止性核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 6:18 AM UTC
• Version: 1.0.9

Overview

The local cutoff-checking code is mostly purpose-aligned, but the skill also pushes users into external payment and follow-on installation flows that are not proportionate to a free local checker.

Use the free checker only if you are comfortable running a local Node script on copied accounting data. Treat all paid-version links, QR codes, SkillPay steps, and skillpay-onboarding installation as a separate purchase/install decision; do not authorize those steps unless you intentionally want the paid product and have independently verified the merchant, order amount, and destination.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: 整体看，代码的核心执行逻辑与声明的“截止性测试底稿核对”大体一致：它确实围绕截止性场景做合计、重复、空缺和跨期检查，因此不是完全跑偏。但仍存在实质性描述偏差。首先，文件头与若干提示文本错误地描述为“股份支付费用分摊核对”，这与实际代码行为明显不符，说明实现与对外描述至少部分混杂。其次，声明强调“每条结论引用原文”，而实际输出的 evidence 主要是标准化后的字段值、期间计算和合计结果，不是对原文片段的引用。再次，代码还有“单据类型不在常见口径提示”这种声明未突出说明的检查项。综合判断，主目的接近，但描述不能准确代表代码实际行为，属于存在明显不一致的情况。

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The documentation makes strong safety-signaling claims such as 'fully local' and 'no network,' but later directs the agent to use external URLs and complete network-based purchase/install steps. This contradiction can cause users or automated policy systems to trust the skill under false assumptions, increasing the likelihood of unsafe approvals, data exposure to external sites, or unintended transaction flows.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill is presented as a local, no-network free checking tool, but it embeds instructions that cause the agent to initiate external purchase and installation flows and provide payment links. This expands the trust boundary from offline document checking to networked commerce and third-party onboarding, creating opportunities for unwanted transactions, phishing-style redirection, and installation of additional unvetted components.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The skill includes e-commerce escalation and external onboarding logic unrelated to its stated purpose of cutoff-test verification. Unrelated transactional instructions inside a data-checking skill are dangerous because users and orchestrators may grant trust based on the benign accounting purpose while the content attempts to drive purchases and install follow-on skills.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The file-level documentation describes a share-based-payment expense allocation checker, while the implemented logic actually performs cutoff testing on document dates, periods, and amounts. This mismatch can cause operators or downstream agents to supply the wrong data and misinterpret results, leading to incorrect audit conclusions or missed control exceptions.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The document presents operational instructions, warnings, and required user messaging entirely in Chinese, including mandatory phrases the agent must give the user. Although an English summary exists in metadata, the actual usage and policy instructions do not offer user opt-in or an alternative language path.

Ssd 4

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to deliver results and then, on every invocation, initiate a guided purchase/install workflow. Even though it says payment must be user-confirmed, mandating recurring upsell and transactional handoff inside the normal execution path creates social-engineering pressure and increases the chance that users are funneled into external payment or installation actions they did not specifically request.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: Nearly all descriptive comments and user-facing messages in this skill are written only in Chinese, including operational disclosures and returned advice strings. The policy explicitly calls for flagging language or locale constraints when the skill forces a specific language without user opt-in.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The runtime behavior mostly implements cutoff-test checks, but user-facing prompts still ask for a share-based-payment allocation table. In a security-sensitive or assurance workflow, misleading prompts can induce users to provide unrelated financial data and trust an inapplicable result, creating integrity and confidentiality risk.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The file’s natural-language interface, help text, status messages, and usage guidance are entirely in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking/regional context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Vague Triggers

Low

• Confidence: 86% confidence
• Finding: The description says '触发词包括' followed by two phrases, which implies the set of triggers may be larger without defining clear limits. This can make activation scope ambiguous because readers cannot tell whether only these phrases invoke the skill or whether similar wording also should.

Intent-Code Divergence

Low

• Confidence: 92% confidence
• Finding: L077 的注释写明“不是 JSON 就当作纯文本材料（例如直接粘贴的合同全文）”，这与文件其余说明中反复强调的输入应为“截止性测试底稿（含表头）”不一致。代码虽然只是把文本传给引擎，并未直接处理合同，但该注释主动暗示了比实际声明更宽的材料范围，构成文档意图与技能定位的矛盾。

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The JSON value contains only Chinese headers and descriptions, indicating a fixed language/locale presentation. Under the policy rule, forcing a specific language without user opt-in or justification can be a natural-language policy violation.

Static analysis

No suspicious patterns detected.