财务月结与对账专家

• Outcome: Pass
• Latest audit: Sep 23, 2026 · 11:27 AM UTC
• Version: 1.0.10

Overview

This is a local finance reconciliation skill with bundled rule engines; its main caveat is a small under-disclosed local usage counter, not evidence of malicious behavior.

Install only if you are comfortable running a local Node-based finance checker on pasted or file-provided table data. Treat its conclusions as reconciliation aids rather than accounting, audit, tax, or legal advice, and note that it creates a small local trial-use counter in your home directory.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (203)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation makes broad, concrete claims about covering 39 finance reconciliation sub-skills, automatic routing, reproducible line-by-line conclusions, and strict refusal to conclude when inputs are incomplete. The static findings consistently indicate the implementation is materially narrower or different, which is a security-relevant trust boundary problem: users may rely on incomplete or wrong analysis in sensitive finance workflows, leading to bad business decisions, missed control gaps, or acceptance of incorrect outputs under false assurance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation makes broad, concrete claims about covering 39 finance reconciliation sub-skills, automatic routing, reproducible line-by-line conclusions, and strict refusal to conclude when inputs are incomplete. The static findings consistently indicate the implementation is materially narrower or different, which is a security-relevant trust boundary problem: users may rely on incomplete or wrong analysis in sensitive finance workflows, leading to bad business decisions, missed control gaps, or acceptance of incorrect outputs under false assurance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation makes broad, concrete claims about covering 39 finance reconciliation sub-skills, automatic routing, reproducible line-by-line conclusions, and strict refusal to conclude when inputs are incomplete. The static findings consistently indicate the implementation is materially narrower or different, which is a security-relevant trust boundary problem: users may rely on incomplete or wrong analysis in sensitive finance workflows, leading to bad business decisions, missed control gaps, or acceptance of incorrect outputs under false assurance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation makes broad, concrete claims about covering 39 finance reconciliation sub-skills, automatic routing, reproducible line-by-line conclusions, and strict refusal to conclude when inputs are incomplete. The static findings consistently indicate the implementation is materially narrower or different, which is a security-relevant trust boundary problem: users may rely on incomplete or wrong analysis in sensitive finance workflows, leading to bad business decisions, missed control gaps, or acceptance of incorrect outputs under false assurance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation makes broad, concrete claims about covering 39 finance reconciliation sub-skills, automatic routing, reproducible line-by-line conclusions, and strict refusal to conclude when inputs are incomplete. The static findings consistently indicate the implementation is materially narrower or different, which is a security-relevant trust boundary problem: users may rely on incomplete or wrong analysis in sensitive finance workflows, leading to bad business decisions, missed control gaps, or acceptance of incorrect outputs under false assurance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation makes broad, concrete claims about covering 39 finance reconciliation sub-skills, automatic routing, reproducible line-by-line conclusions, and strict refusal to conclude when inputs are incomplete. The static findings consistently indicate the implementation is materially narrower or different, which is a security-relevant trust boundary problem: users may rely on incomplete or wrong analysis in sensitive finance workflows, leading to bad business decisions, missed control gaps, or acceptance of incorrect outputs under false assurance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation makes broad, concrete claims about covering 39 finance reconciliation sub-skills, automatic routing, reproducible line-by-line conclusions, and strict refusal to conclude when inputs are incomplete. The static findings consistently indicate the implementation is materially narrower or different, which is a security-relevant trust boundary problem: users may rely on incomplete or wrong analysis in sensitive finance workflows, leading to bad business decisions, missed control gaps, or acceptance of incorrect outputs under false assurance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation makes broad, concrete claims about covering 39 finance reconciliation sub-skills, automatic routing, reproducible line-by-line conclusions, and strict refusal to conclude when inputs are incomplete. The static findings consistently indicate the implementation is materially narrower or different, which is a security-relevant trust boundary problem: users may rely on incomplete or wrong analysis in sensitive finance workflows, leading to bad business decisions, missed control gaps, or acceptance of incorrect outputs under false assurance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation makes broad, concrete claims about covering 39 finance reconciliation sub-skills, automatic routing, reproducible line-by-line conclusions, and strict refusal to conclude when inputs are incomplete. The static findings consistently indicate the implementation is materially narrower or different, which is a security-relevant trust boundary problem: users may rely on incomplete or wrong analysis in sensitive finance workflows, leading to bad business decisions, missed control gaps, or acceptance of incorrect outputs under false assurance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation makes broad, concrete claims about covering 39 finance reconciliation sub-skills, automatic routing, reproducible line-by-line conclusions, and strict refusal to conclude when inputs are incomplete. The static findings consistently indicate the implementation is materially narrower or different, which is a security-relevant trust boundary problem: users may rely on incomplete or wrong analysis in sensitive finance workflows, leading to bad business decisions, missed control gaps, or acceptance of incorrect outputs under false assurance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation makes broad, concrete claims about covering 39 finance reconciliation sub-skills, automatic routing, reproducible line-by-line conclusions, and strict refusal to conclude when inputs are incomplete. The static findings consistently indicate the implementation is materially narrower or different, which is a security-relevant trust boundary problem: users may rely on incomplete or wrong analysis in sensitive finance workflows, leading to bad business decisions, missed control gaps, or acceptance of incorrect outputs under false assurance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation makes broad, concrete claims about covering 39 finance reconciliation sub-skills, automatic routing, reproducible line-by-line conclusions, and strict refusal to conclude when inputs are incomplete. The static findings consistently indicate the implementation is materially narrower or different, which is a security-relevant trust boundary problem: users may rely on incomplete or wrong analysis in sensitive finance workflows, leading to bad business decisions, missed control gaps, or acceptance of incorrect outputs under false assurance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation makes broad, concrete claims about covering 39 finance reconciliation sub-skills, automatic routing, reproducible line-by-line conclusions, and strict refusal to conclude when inputs are incomplete. The static findings consistently indicate the implementation is materially narrower or different, which is a security-relevant trust boundary problem: users may rely on incomplete or wrong analysis in sensitive finance workflows, leading to bad business decisions, missed control gaps, or acceptance of incorrect outputs under false assurance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation makes broad, concrete claims about covering 39 finance reconciliation sub-skills, automatic routing, reproducible line-by-line conclusions, and strict refusal to conclude when inputs are incomplete. The static findings consistently indicate the implementation is materially narrower or different, which is a security-relevant trust boundary problem: users may rely on incomplete or wrong analysis in sensitive finance workflows, leading to bad business decisions, missed control gaps, or acceptance of incorrect outputs under false assurance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation makes broad, concrete claims about covering 39 finance reconciliation sub-skills, automatic routing, reproducible line-by-line conclusions, and strict refusal to conclude when inputs are incomplete. The static findings consistently indicate the implementation is materially narrower or different, which is a security-relevant trust boundary problem: users may rely on incomplete or wrong analysis in sensitive finance workflows, leading to bad business decisions, missed control gaps, or acceptance of incorrect outputs under false assurance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation makes broad, concrete claims about covering 39 finance reconciliation sub-skills, automatic routing, reproducible line-by-line conclusions, and strict refusal to conclude when inputs are incomplete. The static findings consistently indicate the implementation is materially narrower or different, which is a security-relevant trust boundary problem: users may rely on incomplete or wrong analysis in sensitive finance workflows, leading to bad business decisions, missed control gaps, or acceptance of incorrect outputs under false assurance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation makes broad, concrete claims about covering 39 finance reconciliation sub-skills, automatic routing, reproducible line-by-line conclusions, and strict refusal to conclude when inputs are incomplete. The static findings consistently indicate the implementation is materially narrower or different, which is a security-relevant trust boundary problem: users may rely on incomplete or wrong analysis in sensitive finance workflows, leading to bad business decisions, missed control gaps, or acceptance of incorrect outputs under false assurance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation makes broad, concrete claims about covering 39 finance reconciliation sub-skills, automatic routing, reproducible line-by-line conclusions, and strict refusal to conclude when inputs are incomplete. The static findings consistently indicate the implementation is materially narrower or different, which is a security-relevant trust boundary problem: users may rely on incomplete or wrong analysis in sensitive finance workflows, leading to bad business decisions, missed control gaps, or acceptance of incorrect outputs under false assurance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation makes broad, concrete claims about covering 39 finance reconciliation sub-skills, automatic routing, reproducible line-by-line conclusions, and strict refusal to conclude when inputs are incomplete. The static findings consistently indicate the implementation is materially narrower or different, which is a security-relevant trust boundary problem: users may rely on incomplete or wrong analysis in sensitive finance workflows, leading to bad business decisions, missed control gaps, or acceptance of incorrect outputs under false assurance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation makes broad, concrete claims about covering 39 finance reconciliation sub-skills, automatic routing, reproducible line-by-line conclusions, and strict refusal to conclude when inputs are incomplete. The static findings consistently indicate the implementation is materially narrower or different, which is a security-relevant trust boundary problem: users may rely on incomplete or wrong analysis in sensitive finance workflows, leading to bad business decisions, missed control gaps, or acceptance of incorrect outputs under false assurance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation makes broad, concrete claims about covering 39 finance reconciliation sub-skills, automatic routing, reproducible line-by-line conclusions, and strict refusal to conclude when inputs are incomplete. The static findings consistently indicate the implementation is materially narrower or different, which is a security-relevant trust boundary problem: users may rely on incomplete or wrong analysis in sensitive finance workflows, leading to bad business decisions, missed control gaps, or acceptance of incorrect outputs under false assurance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation makes broad, concrete claims about covering 39 finance reconciliation sub-skills, automatic routing, reproducible line-by-line conclusions, and strict refusal to conclude when inputs are incomplete. The static findings consistently indicate the implementation is materially narrower or different, which is a security-relevant trust boundary problem: users may rely on incomplete or wrong analysis in sensitive finance workflows, leading to bad business decisions, missed control gaps, or acceptance of incorrect outputs under false assurance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation makes broad, concrete claims about covering 39 finance reconciliation sub-skills, automatic routing, reproducible line-by-line conclusions, and strict refusal to conclude when inputs are incomplete. The static findings consistently indicate the implementation is materially narrower or different, which is a security-relevant trust boundary problem: users may rely on incomplete or wrong analysis in sensitive finance workflows, leading to bad business decisions, missed control gaps, or acceptance of incorrect outputs under false assurance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation makes broad, concrete claims about covering 39 finance reconciliation sub-skills, automatic routing, reproducible line-by-line conclusions, and strict refusal to conclude when inputs are incomplete. The static findings consistently indicate the implementation is materially narrower or different, which is a security-relevant trust boundary problem: users may rely on incomplete or wrong analysis in sensitive finance workflows, leading to bad business decisions, missed control gaps, or acceptance of incorrect outputs under false assurance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation makes broad, concrete claims about covering 39 finance reconciliation sub-skills, automatic routing, reproducible line-by-line conclusions, and strict refusal to conclude when inputs are incomplete. The static findings consistently indicate the implementation is materially narrower or different, which is a security-relevant trust boundary problem: users may rely on incomplete or wrong analysis in sensitive finance workflows, leading to bad business decisions, missed control gaps, or acceptance of incorrect outputs under false assurance.

Static analysis

No suspicious patterns detected.