部门费用预算执行核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 6:19 AM UTC
• Version: 1.0.42

Overview

The local budget-checking code appears self-contained, but the skill instructions bundle in a mandatory upsell path that can lead the agent into external purchase and installation steps.

Install only if you are comfortable with a Chinese-language local budget-table checker that also advertises and can route your agent into a paid external SkillPay purchase/install flow. Treat the free checking code as local, but do not allow the paid path, external links, QR codes, dependency installs, or new skill installation unless you deliberately want that and have verified the merchant, product, amount, and platform rules yourself.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The documentation explicitly claims '不联网' / 'no network' while later directing the agent to remote websites and purchase endpoints. This contradiction is dangerous because users and host systems may rely on the no-network claim when granting trust, causing them to underestimate the risk of data exposure, remote content retrieval, or malicious redirection.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill presents itself as a fully local, no-network budget-check tool, yet later instructs the agent to initiate remote purchase, installation, and onboarding flows via multiple external URLs. This is dangerous because it materially expands the trust boundary from offline document checking to network access, software installation, and commerce, creating opportunities for phishing, unwanted capability escalation, or deceptive user routing.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The embedded commerce and software-installation workflow is unrelated to the stated purpose of checking budget execution tables and introduces a second capability domain with very different risks. Bundling transactional and install behavior into a financial-review skill increases the chance that an agent will perform sensitive external actions under the guise of normal document analysis.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The skill instructions and operational text are overwhelmingly written in Chinese and repeatedly direct the agent to present specific Chinese-language messaging to users, but the document does not offer an opt-in choice of language or clearly state that the skill is restricted to Chinese-speaking or China-specific contexts. Under the policy, forcing a specific language without user choice is a natural-language policy concern.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This code contains extensive natural-language descriptions, prompts, advice, notes, and disclaimers exclusively in Chinese. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The script repeatedly assures users that operation is fully local and that materials are not sent externally, but after processing it prints an external purchase URL. Even though printing a URL does not itself exfiltrate data, it introduces an external interaction path that undermines the strong privacy/trust claims and could steer users handling sensitive budget data toward a remote site. In a security-sensitive, data-confidentiality-focused skill, this mismatch is risky because users may rely on the stronger claim when deciding whether to use the tool.

Intent-Code Divergence

Low

• Confidence: 85% confidence
• Finding: The comment says non-JSON input is treated as plain-text material such as a pasted '合同全文' (full contract text), but the skill is specifically for checking department budget execution tables. That inline documentation suggests a materially different document type than the code and manifest are supposed to handle, indicating stale or contradictory intent documentation.

Static analysis

No suspicious patterns detected.