Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample
Security audit
报销单合规预检（免费版）
Security checks for vulnerabilities and agentic risk
Overview
This skill runs a local expense-document precheck with user-provided files and does not show hidden network, persistence, credential, or destructive behavior.
Install only if you are comfortable running a local Node-based checker on reimbursement and invoice text. Treat the output as a narrow precheck, not a full compliance, fraud, tax, or invoice-authenticity review.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The top-level comments describe the skill entirely in Chinese, and the implementation is built around Chinese field labels and Chinese-language result messages. There is no indication that language is configurable, optional, or justified as a region-specific constraint, which can violate a language/locale policy requiring user choice or opt-in.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The design-principles comment explicitly states '绝不输出"未发现问题"'. But analyze() sets summary.verdict to '在上述检查项范围内没有发现问题 —— ...' when no P0/P1/P2 findings exist. This is an active contradiction between stated intent and actual behavior, not merely omitted detail.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest says the free skill performs only duplicate invoice number detection, invoice field completeness, and placeholder residue checks. However, the file declares a larger set of withheld checks such as reimbursement total reconciliation, date logic, matching invoice totals to claim amounts, travel-policy overage hints, and tax consistency, and returns them in result.scope, while the module-level documentation at L7-L10 also presents these broader workflow checks as the engine's function. This creates a semantic mismatch about what the skill is for versus what the manifest says it does.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
L076 的注释写明“不是 JSON 就当作纯文本材料（例如直接粘贴的合同全文）”，而该技能清单与清单描述都限定在报销单、发票及贴票核对场景。代码本身确实会接受任意纯文本作为输入，因此这条注释把适用材料表述得比技能声明更宽，和技能既定意图存在轻微偏离。
- Content