医保结算清单与DRG入组核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 6:27 AM UTC
• Version: 1.0.35

Overview

The local checker code appears non-networked, but the skill also steers users into an external paid purchase and skill-installation flow that is not disclosed up front.

Install only if you want a Chinese DRG settlement checker and are comfortable with the skill showing paid upgrade links. Do not let an agent follow payment or installation links automatically; verify merchant, product, amount, and platform policy yourself, and keep sensitive medical or billing data local.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The documentation explicitly claims '不联网' and 'no network', but later directs use of external URLs, purchase pages, and installation guides. This is dangerous because users and host agents may trust the skill under a false local-only assumption, while the embedded instructions actually encourage remote access and transactional activity.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill markets itself as a local, no-network checking tool, but embeds instructions for the agent to initiate external purchase and installation flows. That creates a hidden capability boundary change: an agent executing the skill may hand users off to remote commerce endpoints and install additional components unrelated to the stated local-only function.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill description emphasizes free local checking, but the body instructs the agent to present purchase links/QR codes and potentially continue through a paid installation flow without equivalent up-front warning. This creates a deceptive user experience and raises the risk of social-engineering-style link handoff under the guise of a routine document-checking skill.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The embedded upsell logic instructs the agent to advertise paid options, retrieve purchase instructions, and complete installation steps, which is outside the core purpose of validating settlement/DRG records. This expands the skill from deterministic document checking into commerce orchestration, increasing phishing, user-manipulation, and unwanted external-action risk.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This code contains extensive Chinese-language instructions, messages, and result text intended for end users, but nowhere offers user opt-in for language/locale selection. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is explicitly justified.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The returned disclaimer states the tool provides DRG grouping/tier prompts, but this free-version implementation does not actually execute those checks. In a medical billing workflow, this can mislead users into believing DRG-related anomalies were evaluated when they were silently omitted, causing false assurance and missed reimbursement or compliance issues.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script repeatedly promises that processing is purely local and that materials are not sent externally, but after handling potentially sensitive medical settlement data it prints an external URL as an 'official purchase' path. Even though the code does not automatically exfiltrate data, this creates a trust-boundary mismatch and can socially steer users toward leaving the local workflow and disclosing regulated healthcare data to an external site.

Intent-Code Divergence

Low

• Confidence: 98% confidence
• Finding: The inline documentation says non-JSON input will be treated as plain-text material, giving '直接粘贴的合同全文' as the example. That contradicts the surrounding code and skill purpose, which are specifically about 医保结算清单与DRG入组核对表 rather than contract review.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The JSON value on L2 contains only Chinese-language field names and content, indicating a fixed language/locale behavior. Under the policy rule, forcing a specific language without user opt-in or justification is a natural-language policy concern.

Static analysis

No suspicious patterns detected.