物业与不动产专家

• Outcome: Review
• Latest audit: Sep 23, 2026 · 8:49 AM UTC
• Version: 1.0.10

Overview

The skill mostly performs local property-accounting checks, but it creates a hidden local usage counter and subscription gate that the main skill instructions do not clearly disclose.

Review this before installing if hidden local state or usage gating is unacceptable. The artifact appears to process pasted property/accounting tables locally, but it will create a home-directory usage counter and stop after the free-use limit unless subscribed; users should also treat its financial conclusions as spreadsheet checks, not legal, tax, audit, or contract advice.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (33)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: If the implementation is really a time-of-use electricity billing checker, the top-level 'property expert' framing is materially inaccurate. In an accounts-verification setting, that mismatch can cause analysts to rely on a tool outside its competence and overlook unsupported obligations like rent, concessions, fees, funds, or arrears.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: If the implementation is really a time-of-use electricity billing checker, the top-level 'property expert' framing is materially inaccurate. In an accounts-verification setting, that mismatch can cause analysts to rely on a tool outside its competence and overlook unsupported obligations like rent, concessions, fees, funds, or arrears.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: If the implementation is really a time-of-use electricity billing checker, the top-level 'property expert' framing is materially inaccurate. In an accounts-verification setting, that mismatch can cause analysts to rely on a tool outside its competence and overlook unsupported obligations like rent, concessions, fees, funds, or arrears.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: If the implementation is really a time-of-use electricity billing checker, the top-level 'property expert' framing is materially inaccurate. In an accounts-verification setting, that mismatch can cause analysts to rely on a tool outside its competence and overlook unsupported obligations like rent, concessions, fees, funds, or arrears.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: If the implementation is really a time-of-use electricity billing checker, the top-level 'property expert' framing is materially inaccurate. In an accounts-verification setting, that mismatch can cause analysts to rely on a tool outside its competence and overlook unsupported obligations like rent, concessions, fees, funds, or arrears.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: If the implementation is really a time-of-use electricity billing checker, the top-level 'property expert' framing is materially inaccurate. In an accounts-verification setting, that mismatch can cause analysts to rely on a tool outside its competence and overlook unsupported obligations like rent, concessions, fees, funds, or arrears.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: If the implementation is really a time-of-use electricity billing checker, the top-level 'property expert' framing is materially inaccurate. In an accounts-verification setting, that mismatch can cause analysts to rely on a tool outside its competence and overlook unsupported obligations like rent, concessions, fees, funds, or arrears.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence
• Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The implementation materially diverges from the declared skill purpose: the manifest presents a property/real-estate expert with specific subskills, while this file performs electricity time-of-use bill checking. That mismatch can cause unsafe routing, incorrect user trust assumptions, and application of the wrong engine to uploaded financial data, producing misleading conclusions in a domain where the manifest promises strict scope control.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The top-level documentation states '不计数' and '不写任何统计文件', but the code later creates a hidden directory under the user's home folder and stores a usage counter there. This is dangerous because it undermines informed consent and trust: users are told no tracking/state is written, yet persistent state is silently created and used to enforce access restrictions.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: This sub-skill uses highly generic activation keywords such as “免费” and “对账”, which can cause the router to invoke it for unrelated user requests. In a multi-skill financial/property workflow, ambiguous routing can lead to incorrect analysis, wrong conclusions, or processing of sensitive billing data under the wrong logic path.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger list for this sub-skill contains broad terms like “免费”, “对账”, and “核对” that are not unique to mall concession reconciliation. This creates unsafe overlap with other accounting-oriented skills and can misroute user data or produce incorrect commercial calculations.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: This keyword set relies on underspecified phrases like “免费”, “对账”, and “核算核对”, which are common across many business tasks. As a result, ordinary finance or billing prompts may incorrectly trigger the property fee logic, causing calculation errors or misleading arrears/late-fee determinations.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: Although this sub-skill has some specific wording, it still includes broad triggers like “对账” and “核对” that do not uniquely identify maintenance fund allocation tasks. In a shared routing system, this ambiguity can expose sensitive owner/fund records to the wrong processing logic and yield invalid compliance-related conclusions.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger set includes generic accounting phrases such as “对账”, which are insufficiently specific for public-income disclosure and revenue-sharing checks. This can cause the skill to activate on unrelated reconciliation tasks and return authoritative-sounding but incorrect financial allocations.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: Using broad keywords like “免费”, “对账”, and “核对” for rent-collection reconciliation makes this sub-skill easy to trigger unintentionally. Because it handles delinquency and late-fee calculations, misrouting can produce materially wrong debt assessments or tenant account conclusions.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: This trigger list mixes some specific deposit-refund phrases with broad terms like “免费” and “对账”, leaving the routing scope underdefined. Since the sub-skill concerns refundable deposits and deductions, accidental invocation can lead to incorrect refund determinations or mishandling of sensitive contract/payment data.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation list uses generic terms such as “免费”, “对账”, and “核对”, which are too broad for utility meter reading verification. This can draw in unrelated billing prompts and cause the engine to apply water/electric meter logic where it does not belong, producing inaccurate consumption or invoice results.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: This trigger set is especially risky because it includes very broad words like “财务” in addition to “免费” and “核算核对”. Such generic terms can cause widespread accidental invocation from unrelated finance prompts, leading to misapplied time-of-use electricity billing logic and potentially incorrect payment calculations.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The file’s natural-language description, user-facing advice, sample input headers, and output strings are all written exclusively in Chinese, indicating the skill is intended to operate in a fixed language. The file does not state that Chinese is optional or provide any user opt-in or alternative locale handling, which matches the language/locale policy-violation category.

Static analysis

No suspicious patterns detected.