Security audit

合同与法务专家

Security checks for vulnerabilities and agentic risk

Overview

This local contract-checking skill does not show data theft or remote execution, but it needs review because some financial/legal checks can return conclusions even when required input columns are missing.

Review this before installing if you will rely on it for accounting, legal, audit, or payment decisions. It appears local and non-exfiltrating, but treat results as a checklist aid only: verify the selected subskill, confirm all required columns are present, and do not rely on a 'success' or clean verdict as proof that the full contract/legal issue was reviewed. Also expect a local usage counter and a five-use gate.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (40)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Narrow milestone/payment verification presented as a full contract/legal triage skill is a substantive description-behavior mismatch. In procurement, legal, or finance operations, this can cause users to believe cross-domain contract checks were completed when only a single payment-control workflow was analyzed.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Narrow milestone/payment verification presented as a full contract/legal triage skill is a substantive description-behavior mismatch. In procurement, legal, or finance operations, this can cause users to believe cross-domain contract checks were completed when only a single payment-control workflow was analyzed.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Narrow milestone/payment verification presented as a full contract/legal triage skill is a substantive description-behavior mismatch. In procurement, legal, or finance operations, this can cause users to believe cross-domain contract checks were completed when only a single payment-control workflow was analyzed.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Narrow milestone/payment verification presented as a full contract/legal triage skill is a substantive description-behavior mismatch. In procurement, legal, or finance operations, this can cause users to believe cross-domain contract checks were completed when only a single payment-control workflow was analyzed.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Narrow milestone/payment verification presented as a full contract/legal triage skill is a substantive description-behavior mismatch. In procurement, legal, or finance operations, this can cause users to believe cross-domain contract checks were completed when only a single payment-control workflow was analyzed.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Narrow milestone/payment verification presented as a full contract/legal triage skill is a substantive description-behavior mismatch. In procurement, legal, or finance operations, this can cause users to believe cross-domain contract checks were completed when only a single payment-control workflow was analyzed.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Narrow milestone/payment verification presented as a full contract/legal triage skill is a substantive description-behavior mismatch. In procurement, legal, or finance operations, this can cause users to believe cross-domain contract checks were completed when only a single payment-control workflow was analyzed.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Narrow milestone/payment verification presented as a full contract/legal triage skill is a substantive description-behavior mismatch. In procurement, legal, or finance operations, this can cause users to believe cross-domain contract checks were completed when only a single payment-control workflow was analyzed.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Narrow milestone/payment verification presented as a full contract/legal triage skill is a substantive description-behavior mismatch. In procurement, legal, or finance operations, this can cause users to believe cross-domain contract checks were completed when only a single payment-control workflow was analyzed.

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --list # 看覆盖了哪些子问题
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --list # 看覆盖了哪些子问题
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --list # 看覆盖了哪些子问题
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --list # 看覆盖了哪些子问题
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --list # 看覆盖了哪些子问题
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The module-level contract says that when materials are insufficient, the tool must not give conclusions, but the implementation later proceeds with partial checks and returns a success result. In a legal/finance verification skill, this creates a trust-boundary failure: users may rely on seemingly authoritative conclusions even though required inputs were missing, leading to materially wrong compliance or accounting decisions.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The REQUIRED-column behavior explicitly contradicts the skill's promise to withhold conclusions when inputs are insufficient. Because the tool still produces findings and a verdict, operators may mistake a partial analysis for a complete control check, which is especially risky in contract asset/liability aging review where omissions can mask misstatements.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The inline comment institutionalizes unsafe behavior by stating that conclusions should still be given when required columns are missing. This is dangerous because it normalizes partial-data analysis in a domain where the skill itself promises 'no conclusion' on insufficient materials, increasing the chance that future maintainers preserve or expand the unsafe pattern.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The file implements SaaS vendor invoice reconciliation logic, while the skill manifest presents the skill as a contract/legal expert. This capability mismatch is dangerous because user data may be routed to an unrelated engine path, causing incorrect analysis, data handling outside the declared purpose, and erosion of trust boundaries that downstream orchestration may rely on for authorization or review.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The implementation is materially misaligned with the declared skill purpose: the manifest presents a broad contract/legal expert skill, while this file is a specialized software outsourcing milestone payment checker with subscription gating. In an agent platform, such skill/manifest drift is dangerous because it can cause incorrect routing, unexpected data handling, and hidden behavior that users and reviewers did not consent to, especially when financial/legal conclusions are produced under a misleading identity.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The header comments and help text repeatedly assert 'pure local' and 'all sub-skills in package,' yet the runtime contains explicit branches for subscription-only engines and missing local components. This is dangerous because it undermines user trust and informed consent about what the software actually does, particularly for a legal-analysis skill that may be used on sensitive commercial documents.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The CLI states that all sub-skills are included and fully local, but runtime logic checks for missing engines and blocks some sub-skills as subscription-only. That mismatch can mislead users into exposing sensitive contract data under false assumptions about available functionality and package completeness, especially in a legal/contract-analysis context where predictability and trust are important.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The skill name, summary, primary description, and invocation guidance are presented in Chinese, while the English description is minimal and does not provide equivalent usage details. This creates a locale/language constraint without an explicit user opt-in or a stated region-specific justification, which matches the language-policy concern for natural-language policy violations.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger list includes very generic terms such as “免费”, “对账”, and “核对”, which are common across many unrelated business requests. In an auto-routing skill, this can cause unintended invocation, misclassification of user input, and routing sensitive documents to the wrong sub-skill, increasing the chance of incorrect analysis or unintended data exposure within the agent workflow.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: This sub-skill uses broad keywords such as “合同”, “法务”, “采购”, “模板”, and “内审”, which are too common to uniquely identify a contract-comparison request. In a legal/accounting assistant that auto-dispatches based on keywords, this raises the risk of invoking the comparison workflow on unrelated documents, leading to erroneous outputs and unnecessary processing of sensitive contract text.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: Reusing generic triggers like “对账” and “核对” across multiple sub-skills creates ambiguity in routing and makes accidental activation likely. Because this package processes finance and contract-related records, ambiguous dispatch can result in the wrong reconciliation logic being applied to user data, producing misleading conclusions or mishandling sensitive records.

Static analysis

No suspicious patterns detected.