薪酬社保与人力专家

• Outcome: Review
• Latest audit: Sep 23, 2026 · 9:54 AM UTC
• Version: 1.0.10

Overview

The skill appears to run locally and is not overtly malicious, but it should be reviewed because it handles sensitive payroll data while under-disclosing persistent local usage tracking and some compliance-scope limitations.

Install only after reviewing the local usage counter and paywall behavior. Treat outputs as spreadsheet checks, not legal, tax, payroll, or HR compliance advice, and avoid pasting real employee identifiers unless local processing and this persistent trial counter are acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (115)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a broad payroll/social-security/HR expert that auto-routes one pasted table across 21 sub-skills, but the underlying implementation reportedly only supports a much narrower checker. In this context, that mismatch is security-relevant because users may submit sensitive payroll, tax, social-insurance, and HR data expecting complete coverage and trustworthy conclusions, leading to false assurance, missed compliance issues, and unnecessary exposure of confidential employee data to an inapplicable tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a broad payroll/social-security/HR expert that auto-routes one pasted table across 21 sub-skills, but the underlying implementation reportedly only supports a much narrower checker. In this context, that mismatch is security-relevant because users may submit sensitive payroll, tax, social-insurance, and HR data expecting complete coverage and trustworthy conclusions, leading to false assurance, missed compliance issues, and unnecessary exposure of confidential employee data to an inapplicable tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a broad payroll/social-security/HR expert that auto-routes one pasted table across 21 sub-skills, but the underlying implementation reportedly only supports a much narrower checker. In this context, that mismatch is security-relevant because users may submit sensitive payroll, tax, social-insurance, and HR data expecting complete coverage and trustworthy conclusions, leading to false assurance, missed compliance issues, and unnecessary exposure of confidential employee data to an inapplicable tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a broad payroll/social-security/HR expert that auto-routes one pasted table across 21 sub-skills, but the underlying implementation reportedly only supports a much narrower checker. In this context, that mismatch is security-relevant because users may submit sensitive payroll, tax, social-insurance, and HR data expecting complete coverage and trustworthy conclusions, leading to false assurance, missed compliance issues, and unnecessary exposure of confidential employee data to an inapplicable tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a broad payroll/social-security/HR expert that auto-routes one pasted table across 21 sub-skills, but the underlying implementation reportedly only supports a much narrower checker. In this context, that mismatch is security-relevant because users may submit sensitive payroll, tax, social-insurance, and HR data expecting complete coverage and trustworthy conclusions, leading to false assurance, missed compliance issues, and unnecessary exposure of confidential employee data to an inapplicable tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a broad payroll/social-security/HR expert that auto-routes one pasted table across 21 sub-skills, but the underlying implementation reportedly only supports a much narrower checker. In this context, that mismatch is security-relevant because users may submit sensitive payroll, tax, social-insurance, and HR data expecting complete coverage and trustworthy conclusions, leading to false assurance, missed compliance issues, and unnecessary exposure of confidential employee data to an inapplicable tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a broad payroll/social-security/HR expert that auto-routes one pasted table across 21 sub-skills, but the underlying implementation reportedly only supports a much narrower checker. In this context, that mismatch is security-relevant because users may submit sensitive payroll, tax, social-insurance, and HR data expecting complete coverage and trustworthy conclusions, leading to false assurance, missed compliance issues, and unnecessary exposure of confidential employee data to an inapplicable tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a broad payroll/social-security/HR expert that auto-routes one pasted table across 21 sub-skills, but the underlying implementation reportedly only supports a much narrower checker. In this context, that mismatch is security-relevant because users may submit sensitive payroll, tax, social-insurance, and HR data expecting complete coverage and trustworthy conclusions, leading to false assurance, missed compliance issues, and unnecessary exposure of confidential employee data to an inapplicable tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a broad payroll/social-security/HR expert that auto-routes one pasted table across 21 sub-skills, but the underlying implementation reportedly only supports a much narrower checker. In this context, that mismatch is security-relevant because users may submit sensitive payroll, tax, social-insurance, and HR data expecting complete coverage and trustworthy conclusions, leading to false assurance, missed compliance issues, and unnecessary exposure of confidential employee data to an inapplicable tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a broad payroll/social-security/HR expert that auto-routes one pasted table across 21 sub-skills, but the underlying implementation reportedly only supports a much narrower checker. In this context, that mismatch is security-relevant because users may submit sensitive payroll, tax, social-insurance, and HR data expecting complete coverage and trustworthy conclusions, leading to false assurance, missed compliance issues, and unnecessary exposure of confidential employee data to an inapplicable tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a broad payroll/social-security/HR expert that auto-routes one pasted table across 21 sub-skills, but the underlying implementation reportedly only supports a much narrower checker. In this context, that mismatch is security-relevant because users may submit sensitive payroll, tax, social-insurance, and HR data expecting complete coverage and trustworthy conclusions, leading to false assurance, missed compliance issues, and unnecessary exposure of confidential employee data to an inapplicable tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a broad payroll/social-security/HR expert that auto-routes one pasted table across 21 sub-skills, but the underlying implementation reportedly only supports a much narrower checker. In this context, that mismatch is security-relevant because users may submit sensitive payroll, tax, social-insurance, and HR data expecting complete coverage and trustworthy conclusions, leading to false assurance, missed compliance issues, and unnecessary exposure of confidential employee data to an inapplicable tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a broad payroll/social-security/HR expert that auto-routes one pasted table across 21 sub-skills, but the underlying implementation reportedly only supports a much narrower checker. In this context, that mismatch is security-relevant because users may submit sensitive payroll, tax, social-insurance, and HR data expecting complete coverage and trustworthy conclusions, leading to false assurance, missed compliance issues, and unnecessary exposure of confidential employee data to an inapplicable tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a broad payroll/social-security/HR expert that auto-routes one pasted table across 21 sub-skills, but the underlying implementation reportedly only supports a much narrower checker. In this context, that mismatch is security-relevant because users may submit sensitive payroll, tax, social-insurance, and HR data expecting complete coverage and trustworthy conclusions, leading to false assurance, missed compliance issues, and unnecessary exposure of confidential employee data to an inapplicable tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a broad payroll/social-security/HR expert that auto-routes one pasted table across 21 sub-skills, but the underlying implementation reportedly only supports a much narrower checker. In this context, that mismatch is security-relevant because users may submit sensitive payroll, tax, social-insurance, and HR data expecting complete coverage and trustworthy conclusions, leading to false assurance, missed compliance issues, and unnecessary exposure of confidential employee data to an inapplicable tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a broad payroll/social-security/HR expert that auto-routes one pasted table across 21 sub-skills, but the underlying implementation reportedly only supports a much narrower checker. In this context, that mismatch is security-relevant because users may submit sensitive payroll, tax, social-insurance, and HR data expecting complete coverage and trustworthy conclusions, leading to false assurance, missed compliance issues, and unnecessary exposure of confidential employee data to an inapplicable tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a broad payroll/social-security/HR expert that auto-routes one pasted table across 21 sub-skills, but the underlying implementation reportedly only supports a much narrower checker. In this context, that mismatch is security-relevant because users may submit sensitive payroll, tax, social-insurance, and HR data expecting complete coverage and trustworthy conclusions, leading to false assurance, missed compliance issues, and unnecessary exposure of confidential employee data to an inapplicable tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a broad payroll/social-security/HR expert that auto-routes one pasted table across 21 sub-skills, but the underlying implementation reportedly only supports a much narrower checker. In this context, that mismatch is security-relevant because users may submit sensitive payroll, tax, social-insurance, and HR data expecting complete coverage and trustworthy conclusions, leading to false assurance, missed compliance issues, and unnecessary exposure of confidential employee data to an inapplicable tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a broad payroll/social-security/HR expert that auto-routes one pasted table across 21 sub-skills, but the underlying implementation reportedly only supports a much narrower checker. In this context, that mismatch is security-relevant because users may submit sensitive payroll, tax, social-insurance, and HR data expecting complete coverage and trustworthy conclusions, leading to false assurance, missed compliance issues, and unnecessary exposure of confidential employee data to an inapplicable tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a broad payroll/social-security/HR expert that auto-routes one pasted table across 21 sub-skills, but the underlying implementation reportedly only supports a much narrower checker. In this context, that mismatch is security-relevant because users may submit sensitive payroll, tax, social-insurance, and HR data expecting complete coverage and trustworthy conclusions, leading to false assurance, missed compliance issues, and unnecessary exposure of confidential employee data to an inapplicable tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a broad payroll/social-security/HR expert that auto-routes one pasted table across 21 sub-skills, but the underlying implementation reportedly only supports a much narrower checker. In this context, that mismatch is security-relevant because users may submit sensitive payroll, tax, social-insurance, and HR data expecting complete coverage and trustworthy conclusions, leading to false assurance, missed compliance issues, and unnecessary exposure of confidential employee data to an inapplicable tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a broad payroll/social-security/HR expert that auto-routes one pasted table across 21 sub-skills, but the underlying implementation reportedly only supports a much narrower checker. In this context, that mismatch is security-relevant because users may submit sensitive payroll, tax, social-insurance, and HR data expecting complete coverage and trustworthy conclusions, leading to false assurance, missed compliance issues, and unnecessary exposure of confidential employee data to an inapplicable tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a broad payroll/social-security/HR expert that auto-routes one pasted table across 21 sub-skills, but the underlying implementation reportedly only supports a much narrower checker. In this context, that mismatch is security-relevant because users may submit sensitive payroll, tax, social-insurance, and HR data expecting complete coverage and trustworthy conclusions, leading to false assurance, missed compliance issues, and unnecessary exposure of confidential employee data to an inapplicable tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a broad payroll/social-security/HR expert that auto-routes one pasted table across 21 sub-skills, but the underlying implementation reportedly only supports a much narrower checker. In this context, that mismatch is security-relevant because users may submit sensitive payroll, tax, social-insurance, and HR data expecting complete coverage and trustworthy conclusions, leading to false assurance, missed compliance issues, and unnecessary exposure of confidential employee data to an inapplicable tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a broad payroll/social-security/HR expert that auto-routes one pasted table across 21 sub-skills, but the underlying implementation reportedly only supports a much narrower checker. In this context, that mismatch is security-relevant because users may submit sensitive payroll, tax, social-insurance, and HR data expecting complete coverage and trustworthy conclusions, leading to false assurance, missed compliance issues, and unnecessary exposure of confidential employee data to an inapplicable tool.

Static analysis

No suspicious patterns detected.