物流与运输结算专家

• Outcome: Pass
• Latest audit: Sep 23, 2026 · 8:34 AM UTC
• Version: 1.0.10

Overview

The skill locally checks pasted logistics settlement tables and shows no evidence of network exfiltration, destructive actions, or hidden high-impact behavior.

Install only if you are comfortable with a Chinese-language local Node CLI that reads pasted settlement data or a file you explicitly pass. Treat results as reconciliation advice, not authorization to pay or withhold money, and note that normal use creates a local trial-use counter at ~/.logistics-expert/uses.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (30)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: If the code only performs warehouse fee and aging checks but the documentation promises approximately 10 transport-settlement domains including insurance, COD, driver freight, and fuel-card audits, the skill can materially mislead users about review coverage. In an enterprise reconciliation context, this can lead to under-detected errors, financial loss, and weakened auditability.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: If the code only performs warehouse fee and aging checks but the documentation promises approximately 10 transport-settlement domains including insurance, COD, driver freight, and fuel-card audits, the skill can materially mislead users about review coverage. In an enterprise reconciliation context, this can lead to under-detected errors, financial loss, and weakened auditability.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: If the code only performs warehouse fee and aging checks but the documentation promises approximately 10 transport-settlement domains including insurance, COD, driver freight, and fuel-card audits, the skill can materially mislead users about review coverage. In an enterprise reconciliation context, this can lead to under-detected errors, financial loss, and weakened auditability.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: If the code only performs warehouse fee and aging checks but the documentation promises approximately 10 transport-settlement domains including insurance, COD, driver freight, and fuel-card audits, the skill can materially mislead users about review coverage. In an enterprise reconciliation context, this can lead to under-detected errors, financial loss, and weakened auditability.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: If the code only performs warehouse fee and aging checks but the documentation promises approximately 10 transport-settlement domains including insurance, COD, driver freight, and fuel-card audits, the skill can materially mislead users about review coverage. In an enterprise reconciliation context, this can lead to under-detected errors, financial loss, and weakened auditability.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: If the code only performs warehouse fee and aging checks but the documentation promises approximately 10 transport-settlement domains including insurance, COD, driver freight, and fuel-card audits, the skill can materially mislead users about review coverage. In an enterprise reconciliation context, this can lead to under-detected errors, financial loss, and weakened auditability.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: If the code only performs warehouse fee and aging checks but the documentation promises approximately 10 transport-settlement domains including insurance, COD, driver freight, and fuel-card audits, the skill can materially mislead users about review coverage. In an enterprise reconciliation context, this can lead to under-detected errors, financial loss, and weakened auditability.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: If the code only performs warehouse fee and aging checks but the documentation promises approximately 10 transport-settlement domains including insurance, COD, driver freight, and fuel-card audits, the skill can materially mislead users about review coverage. In an enterprise reconciliation context, this can lead to under-detected errors, financial loss, and weakened auditability.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest describes a skill focused on logistics and transportation settlement areas such as cargo insurance, branch freight/COD reconciliation, driver freight settlement, fleet fuel consumption, cargo damage claims, and fuel card checks. In contrast, this file is explicitly for '物流仓储与操作费核对' and performs warehouse storage fee, handling fee, overdue fee, and return fee reconciliation, which is a different business domain not covered by the manifest description.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence
• Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The manifest uses a language-specific top-level field “zh” and all visible names/keywords are in Chinese, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking region. This may violate a language/locale policy if the organization requires user opt-in or documented justification for locale constraints.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest uses highly generic trigger keywords such as “免费”, “对账”, and “核对”, which are likely to match many unrelated user requests. This can cause the logistics skill or a wrong subskill to activate unexpectedly, increasing the chance of inappropriate data handling, user confusion, or incorrect workflow execution.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: Multiple subskills reuse the same generic triggers without clear scope boundaries, so the router may have difficulty distinguishing which settlement-checking function the user actually wants. In a skill that auto-routes uploaded tables, this raises the risk of misclassification and incorrect financial reconciliation conclusions being produced under the wrong business rules.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: Using “结算” as a standalone trigger is overly broad because it appears in many routine logistics, finance, and warehouse contexts that may not correspond to this specific subskill. This broad match increases accidental activation risk and may route user data into an unintended analysis path.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file’s natural-language documentation and user-facing messages are written exclusively in Chinese, which effectively forces a specific language for interaction and output. The file does not indicate that the skill is region-specific or provide any user opt-in or alternative language support.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: Returned advice and error messages throughout the code are hard-coded in Chinese, which enforces a single language at runtime. There is no mechanism for the user to choose language or any documented justification for the locale restriction.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file’s natural-language documentation, sample input schema, field labels, user-facing advice, and error/disclaimer messages are all written exclusively in Chinese. There is no indication that the skill is region-specific or that users can opt into another language, so this effectively imposes a specific language/locale on users.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The file’s user-facing description and operational guidance are entirely in Chinese and present the skill as intended to be used in that language, with no indication that other languages are supported or that the user can opt in to a locale. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The file’s user-facing documentation, labels, sample input, advice, and output strings are all written in Chinese and assume Chinese-language interaction. There is no natural-language indication that other languages are supported or that the user can opt into a locale, which can violate a language-choice policy when such forcing is undocumented.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This JavaScript file contains natural-language instructions, labels, sample input, and return messages entirely in Chinese, including the expected input schema and insufficiency advice. There is no indication that the skill is region-specific or that users can opt into Chinese, which can violate language/locale policy for generally applicable skills.

Static analysis

No suspicious patterns detected.