Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
- 该代码块的主功能与声明中的其中一项“电商平台结算核对”一致，且行为是离线、确定性的文本表格复核，没有发现越权访问、联网或其他未声明的敏感能力。但从描述看，整个技能免费版应执行 3 类核对；而提供的代码文件明确自称是“免费档子集”，实际只实现平台结算核对相关规则，未实现另外两类检查。因此描述对该代码块的能力范围构成了实质性高估，属于描述与实际行为不一致。
Security audit
电商财务月度自查包（免费版）
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local, deterministic ecommerce finance reconciliation checker with no evidence of networking, credential access, persistence, or hidden behavior.
Install only if you are comfortable processing ecommerce finance reconciliation tables locally through this skill. Invoke it explicitly rather than relying on broad trigger words, and remember it checks arithmetic and table consistency only; it does not replace accounting, audit, tax, banking, or contract review.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
- 从代码内容看，文件头注释和 service_type 都明确表明这是“直播佣金与坑位费结算核对”模块。其行为仅围绕直播结算表进行本地解析和算术勾稽，包括应付佣金复算、实际应付复算、合计行复核、重复行检测、空白/占位符检测和负数检测。代码没有实现声明中所说免费版应包含的另外两类核对（电商平台结算核对、促销补贴与核销核对）。虽然这可能只是整个技能包中的一个分段文件，但就“所 supplied code chunk 实际做什么”与“声明整体能力”对照而言，存在明显范围不一致：描述声称免费版执行 3 类，而该代码块只体现 1 类。因此应判定为描述与代码行为不匹配。
Vague Triggers
High
- Confidence
- 98% confidence
- Finding
- An ambiguous, very short trigger token is especially risky because it can collide with ordinary language and spur unintended skill routing. Given this skill handles business-finance self-check workflows, such collisions could lead to inadvertent disclosure of commercially sensitive records or confusion about which checks are actually being run.
Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Vague Triggers
Medium
- Confidence
- 95% confidence
- Finding
- Overly broad trigger phrases can cause the skill to activate in unrelated conversations, increasing the chance that users unintentionally expose sensitive financial documents or receive responses from the wrong skill. In a finance-oriented skill, accidental activation is more concerning because inputs may contain settlement, commission, or subsidy data that should only be processed deliberately.
Natural-Language Policy Violations
Medium
- Confidence
- 89% confidence
- Finding
- The file’s natural-language interface, examples, missing-input advice, and disclaimer are all written as mandatory Chinese-facing content, and there is no indication that users may choose another language. Under the policy, a skill that forces a specific language without user opt-in can be a locale-policy violation unless the restriction is clearly documented and justified.
Natural-Language Policy Violations
Medium
- Confidence
- 95% confidence
- Finding
- The file’s natural-language description, usage guidance, and result/advice strings are all presented in Chinese, which effectively forces a specific language for interaction. The policy allows locale constraints only when justified or when the user is given a choice, neither of which is stated here.
Natural-Language Policy Violations
Medium
- Confidence
- 97% confidence
- Finding
- The file’s natural-language comments and user-facing guidance are entirely in Chinese, including operational instructions and disclaimers, with no indication that the skill supports other languages or that Chinese is a justified locale restriction. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Natural-Language Policy Violations
Medium
- Confidence
- 92% confidence
- Finding
- All user-facing descriptions, usage text, errors, and output strings in this script are presented only in Chinese, indicating a fixed language choice. The policy allows locale constraints only when explicitly justified or when the user is given a choice, neither of which is present here.
Natural-Language Policy Violations
Medium
- Confidence
- 90% confidence
- Finding
- The JSON content is entirely in Chinese and presents a fixed Chinese-language template with no indication that language selection is optional. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is documented and justified.
Intent-Code Divergence
Low
- Confidence
- 79% confidence
- Finding
- The inline documentation states that non-JSON input will be handled as plain text material, giving '例如直接粘贴的合同全文' as an example. Elsewhere in the file, the skill consistently describes its intended input as segmented ecommerce checking materials with table headers, so citing a full contract as the expected fallback input contradicts the stated purpose and input model.
Static analysis
No suspicious patterns detected.