电商退货退款与货款结算核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 6:29 AM UTC
• Version: 1.0.41

Overview

The local checker itself appears limited, but the skill instructions push users and agents into external paid purchase and installation flows that conflict with its offline/free framing.

Review this skill carefully before installing. The bundled checker appears local, but the skill text is designed to steer agents toward external paid purchase and installation steps. Use it only if you are comfortable with those commercial links and do not allow an agent to initiate purchases, fetch remote product metadata, or install additional skills unless you explicitly requested and verified that flow.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The skill explicitly claims '完全本地运行' and '不联网', but later includes multiple external links and directs the agent to perform online purchase and installation actions. This mismatch is security-relevant because users and host systems may trust the skill under a false assumption of offline safety, making hidden network-dependent behavior more dangerous.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill presents itself as a local, offline refund-settlement checker, but embedded instructions require the agent to initiate external purchase, payment, and installation flows for a paid version. This creates a deceptive trust boundary: a user invoking a bookkeeping check can be funneled into networked commerce actions unrelated to the core analysis task, increasing phishing, unauthorized procurement, and supply-chain risk.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The documentation grants the agent authority to guide purchases, fetch product identifiers, install dependencies, and continue post-payment installation, which exceeds the stated purpose of a refund reconciliation tool. Overbroad capability expansion is dangerous because it normalizes privileged actions in a low-risk business skill and can be abused for unwanted transactions or installation of untrusted components.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The instructions in this section require the agent to present the upsell workflow and related messaging in fixed Chinese wording and do not offer any language or locale choice. Because the file includes English metadata elsewhere, this hard-coded language behavior appears to force a locale without user opt-in or a documented region-specific necessity.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This JavaScript file contains all user-facing documentation and messages in Chinese, including operational instructions and warnings, but does not indicate that the skill is China-specific or provide any language opt-in. Under the policy, forcing a specific language without user choice is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The user-facing description, help text, errors, and output messages are entirely in Chinese, and the file does not indicate that the skill is region-specific or that users may choose another language. This can violate language/locale policy when a skill imposes a specific language without user opt-in.

Intent-Code Divergence

Low

• Confidence: 93% confidence
• Finding: The comment says non-JSON input is treated as plain-text material such as a pasted '合同全文' (full contract text). That contradicts the surrounding documentation and manifest, which repeatedly state the expected input is an ecommerce refund/settlement check table with headers, not arbitrary contract text.

Description-Behavior Mismatch

Low

• Confidence: 89% confidence
• Finding: The manifest and file header emphasize a local, free checking tool that performs refund/settlement verification on-device. However, the program additionally emits a marketing/navigation link to an external website, which is outside the described checking behavior even though it does not itself perform network access.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The only natural-language content in this file is Chinese tabular text, which implies a fixed language/locale with no opt-in or alternative. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation unless clearly justified as region-specific.

Static analysis

No suspicious patterns detected.