Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
承运司机运费结算核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
The free local checker appears to do its stated reconciliation task, but it also embeds purchase and unpinned remote install instructions that go beyond the local no-network/no-payment framing.
Install only if you are comfortable with a Chinese-language local checker that also promotes a paid upgrade. Use the free checker without following the purchase prompt unless you independently trust the SkillPay/Alipay flow; do not let an agent run the unpinned `npx ... @latest` install or initiate payment without explicit human review.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)
Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Natural-Language Policy Violations
Medium
- Confidence
- 88% confidence
- Finding
- The visible title, descriptions, usage guidance, and embedded user-facing purchase/install text are all written to be used in Chinese, while the English text is only a brief summary and does not present an equivalent user-operable flow. This effectively imposes a specific language/locale without opt-in or an explicit limitation statement, which matches the language/locale policy violation criteria.
Intent-Code Divergence
Medium
- Confidence
- 91% confidence
- Finding
- The metadata claims the tool requires 'no network', but later sections direct the user to web pages and an online purchase/install flow. This inconsistency can mislead users and downstream agents about the trust boundary, causing them to treat the skill as purely local when it actually introduces external network and transaction dependencies.
Context-Inappropriate Capability
Medium
- Confidence
- 93% confidence
- Finding
- The settlement-checking skill embeds unrelated upsell and purchase/install instructions, including external URLs and a scripted message telling another AI assistant how to buy and install a different product. This expands the skill's effective scope from local document checking into commerce and software installation, increasing phishing, social-engineering, and unintended tool-use risk.
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
- The skill instructs the agent/user to run `npx -y @alipay/agent-payment@latest install`, which fetches and executes remote code without a pinned version. This creates a supply-chain risk: if the package is compromised or changes behavior, the user may execute unintended code during a payment/install flow.
Natural-Language Policy Violations
Medium
- Confidence
- 95% confidence
- Finding
- This code file contains extensive natural-language documentation and user-facing output that presumes Chinese as the required language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
Natural-Language Policy Violations
Medium
- Confidence
- 95% confidence
- Finding
- The file's user-facing description, usage, prompts, and result messages are entirely in Chinese, and there is no indication that users may choose another language or locale. Under the policy for natural-language violations, forcing a specific language without user opt-in is in scope even when it appears in code comments or string literals.
Description-Behavior Mismatch
Low
- Confidence
- 95% confidence
- Finding
- The manifest describes a free local checker for driver freight settlement reconciliation tasks. However, after producing results, the script prints purchase links and a version-choice upsell flow, which is not part of the stated checking capability and adds behavior beyond the described audit function.
Intent-Code Divergence
Low
- Confidence
- 98% confidence
- Finding
- The inline comment says the A/B upgrade prompt should appear '同一会话最多 1 次', implying session-scoped behavior. The code instead writes a marker file under os.tmpdir() and suppresses future prompts based on that file, which can outlive a single session and affects later executions.
Natural-Language Policy Violations
Low
- Confidence
- 86% confidence
- Finding
- The JSON value consists entirely of Chinese headers and records, with no indication that language selection is optional or that the skill is intentionally region-specific. Under the policy rule, fixed locale/language content can be a natural-language policy violation when no opt-in or justification is provided.
Static analysis
No suspicious patterns detected.