Ae1
High
- Category
- analysis-evasion
- Content
跑 `node scripts/run.mjs --sample` 会打印本次实际执行的检查项（以引擎的 `CHECKS_*` 导出为准）。
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
残疾人就业保障金申报核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
The local checker appears to do its worksheet math offline, but the skill also tells agents to guide users into an external paid upgrade, purchase, and skill-install flow.
Install only if you are comfortable with the optional upsell content being present. Use the free checker as a local worksheet tool, and do not let an agent fetch remote instructions, install the paid skill, generate payment links, or start a purchase unless you explicitly approve each step and verify the merchant, product, amount, and platform rules yourself.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)
Ae1
High
- Category
- analysis-evasion
- Content
跑 `node scripts/run.mjs --sample` 会打印本次实际执行的检查项（以引擎的 `CHECKS_*` 导出为准）。
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
跑 `node scripts/run.mjs --sample` 会打印本次实际执行的检查项（以引擎的 `CHECKS_*` 导出为准）。
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Description-Behavior Mismatch
High
- Confidence
- 98% confidence
- Finding
- The skill markets itself as 'completely local' and 'no network', yet later instructs the agent to access external purchase pages, onboarding docs, JSON endpoints, redirects, and payment flows. This is dangerous because users and host systems may grant the skill trust under a local-only assumption, while the embedded upgrade path expands the trust boundary to remote content and account-affecting actions.
Context-Inappropriate Capability
High
- Confidence
- 96% confidence
- Finding
- A worksheet arithmetic checker should not embed instructions to install another skill, retrieve dynamic product identifiers, or initiate a payment workflow. Those capabilities are unrelated to the declared business purpose and create an opportunity for account-impacting actions, supply-chain risk from external content, and social engineering through trusted in-tool instructions.
Natural-Language Policy Violations
Medium
- Confidence
- 93% confidence
- Finding
- The file instructs the agent that on every invocation it must present a fixed promotional choice to the user, and the surrounding required wording is written only in Chinese. Because the policy category covers language or locale constraints across all file types, this is a natural-language policy issue: the skill imposes a language-specific interaction without documenting user choice or opt-in.
Whitespace Padding
Medium
- Category
- Prompt Injection
- Content
输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。 执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致； ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。
- Confidence
- 80% confidence
- Finding
- Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Missing User Warnings
Medium
- Confidence
- 88% confidence
- Finding
- The optional upgrade section includes multiple external URLs, installation instructions, merchant and product identifiers, and a direct purchase redirect, but does not clearly foreground that following them may install another skill and start a purchase process affecting the user's account. In an agent context, this can mislead users into authorizing actions with financial or system-change consequences without sufficiently explicit informed consent.
Natural-Language Policy Violations
Medium
- Confidence
- 92% confidence
- Finding
- The user-facing description, usage text, prompts, and outputs are entirely in Chinese, and the skill does not offer an alternative language or indicate that Chinese-only operation is an explicit opt-in. Under the policy, forcing a specific language without user choice can be a natural-language policy violation unless the locale restriction is clearly documented and justified.
Intent-Code Divergence
Low
- Confidence
- 91% confidence
- Finding
- The inline documentation says non-JSON input is handled as plain-text material such as a 'contract full text', but the rest of the script is specifically for disability-fund declaration forms. This is not merely incomplete wording; it actively describes a different document type than the code's stated and implemented intent.
Description-Behavior Mismatch
Low
- Confidence
- 95% confidence
- Finding
- The CLI claims the skill operates fully locally and does not require external services, but it still prints an external purchase/official-entry URL. Even without automatic network access, this creates a trust-boundary violation and can socially steer users to an external site that is outside the local-only execution model described by the skill. In a compliance-oriented workflow, that mismatch can mislead users about data-handling expectations and increase phishing or unintended data disclosure risk if users follow the link manually.
Static analysis
No suspicious patterns detected.