资金与票据专家

• Outcome: Review
• Latest audit: Sep 23, 2026 · 9:10 AM UTC
• Version: 1.0.10

Overview

The skill appears to run locally, but it under-discloses a persistent trial counter/subscription gate and a broader treasury-pack processing mode than the main skill page describes.

Review before installing if you expect a fully free, no-state local checker. It processes pasted or specified financial tables locally and I found no network exfiltration, but it writes a hidden local usage counter and may run broader bundled checks/aggregation than the main skill page makes clear.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (69)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This summary finding consolidates the broader pattern: the skill declares a simple 12-subskill table router, but the implementation spans a different and larger set of checks, batch processing modes, and undeclared export/aggregation features. Undeclared scope and hidden behavior are risky in financial tooling because users cannot accurately assess what data is processed or what assurances the output actually provides.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This summary finding consolidates the broader pattern: the skill declares a simple 12-subskill table router, but the implementation spans a different and larger set of checks, batch processing modes, and undeclared export/aggregation features. Undeclared scope and hidden behavior are risky in financial tooling because users cannot accurately assess what data is processed or what assurances the output actually provides.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This summary finding consolidates the broader pattern: the skill declares a simple 12-subskill table router, but the implementation spans a different and larger set of checks, batch processing modes, and undeclared export/aggregation features. Undeclared scope and hidden behavior are risky in financial tooling because users cannot accurately assess what data is processed or what assurances the output actually provides.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This summary finding consolidates the broader pattern: the skill declares a simple 12-subskill table router, but the implementation spans a different and larger set of checks, batch processing modes, and undeclared export/aggregation features. Undeclared scope and hidden behavior are risky in financial tooling because users cannot accurately assess what data is processed or what assurances the output actually provides.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This summary finding consolidates the broader pattern: the skill declares a simple 12-subskill table router, but the implementation spans a different and larger set of checks, batch processing modes, and undeclared export/aggregation features. Undeclared scope and hidden behavior are risky in financial tooling because users cannot accurately assess what data is processed or what assurances the output actually provides.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This summary finding consolidates the broader pattern: the skill declares a simple 12-subskill table router, but the implementation spans a different and larger set of checks, batch processing modes, and undeclared export/aggregation features. Undeclared scope and hidden behavior are risky in financial tooling because users cannot accurately assess what data is processed or what assurances the output actually provides.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This summary finding consolidates the broader pattern: the skill declares a simple 12-subskill table router, but the implementation spans a different and larger set of checks, batch processing modes, and undeclared export/aggregation features. Undeclared scope and hidden behavior are risky in financial tooling because users cannot accurately assess what data is processed or what assurances the output actually provides.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This summary finding consolidates the broader pattern: the skill declares a simple 12-subskill table router, but the implementation spans a different and larger set of checks, batch processing modes, and undeclared export/aggregation features. Undeclared scope and hidden behavior are risky in financial tooling because users cannot accurately assess what data is processed or what assurances the output actually provides.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This summary finding consolidates the broader pattern: the skill declares a simple 12-subskill table router, but the implementation spans a different and larger set of checks, batch processing modes, and undeclared export/aggregation features. Undeclared scope and hidden behavior are risky in financial tooling because users cannot accurately assess what data is processed or what assurances the output actually provides.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This summary finding consolidates the broader pattern: the skill declares a simple 12-subskill table router, but the implementation spans a different and larger set of checks, batch processing modes, and undeclared export/aggregation features. Undeclared scope and hidden behavior are risky in financial tooling because users cannot accurately assess what data is processed or what assurances the output actually provides.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This summary finding consolidates the broader pattern: the skill declares a simple 12-subskill table router, but the implementation spans a different and larger set of checks, batch processing modes, and undeclared export/aggregation features. Undeclared scope and hidden behavior are risky in financial tooling because users cannot accurately assess what data is processed or what assurances the output actually provides.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This summary finding consolidates the broader pattern: the skill declares a simple 12-subskill table router, but the implementation spans a different and larger set of checks, batch processing modes, and undeclared export/aggregation features. Undeclared scope and hidden behavior are risky in financial tooling because users cannot accurately assess what data is processed or what assurances the output actually provides.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This summary finding consolidates the broader pattern: the skill declares a simple 12-subskill table router, but the implementation spans a different and larger set of checks, batch processing modes, and undeclared export/aggregation features. Undeclared scope and hidden behavior are risky in financial tooling because users cannot accurately assess what data is processed or what assurances the output actually provides.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This summary finding consolidates the broader pattern: the skill declares a simple 12-subskill table router, but the implementation spans a different and larger set of checks, batch processing modes, and undeclared export/aggregation features. Undeclared scope and hidden behavior are risky in financial tooling because users cannot accurately assess what data is processed or what assurances the output actually provides.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This summary finding consolidates the broader pattern: the skill declares a simple 12-subskill table router, but the implementation spans a different and larger set of checks, batch processing modes, and undeclared export/aggregation features. Undeclared scope and hidden behavior are risky in financial tooling because users cannot accurately assess what data is processed or what assurances the output actually provides.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This summary finding consolidates the broader pattern: the skill declares a simple 12-subskill table router, but the implementation spans a different and larger set of checks, batch processing modes, and undeclared export/aggregation features. Undeclared scope and hidden behavior are risky in financial tooling because users cannot accurately assess what data is processed or what assurances the output actually provides.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This summary finding consolidates the broader pattern: the skill declares a simple 12-subskill table router, but the implementation spans a different and larger set of checks, batch processing modes, and undeclared export/aggregation features. Undeclared scope and hidden behavior are risky in financial tooling because users cannot accurately assess what data is processed or what assurances the output actually provides.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This summary finding consolidates the broader pattern: the skill declares a simple 12-subskill table router, but the implementation spans a different and larger set of checks, batch processing modes, and undeclared export/aggregation features. Undeclared scope and hidden behavior are risky in financial tooling because users cannot accurately assess what data is processed or what assurances the output actually provides.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This summary finding consolidates the broader pattern: the skill declares a simple 12-subskill table router, but the implementation spans a different and larger set of checks, batch processing modes, and undeclared export/aggregation features. Undeclared scope and hidden behavior are risky in financial tooling because users cannot accurately assess what data is processed or what assurances the output actually provides.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This summary finding consolidates the broader pattern: the skill declares a simple 12-subskill table router, but the implementation spans a different and larger set of checks, batch processing modes, and undeclared export/aggregation features. Undeclared scope and hidden behavior are risky in financial tooling because users cannot accurately assess what data is processed or what assurances the output actually provides.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This summary finding consolidates the broader pattern: the skill declares a simple 12-subskill table router, but the implementation spans a different and larger set of checks, batch processing modes, and undeclared export/aggregation features. Undeclared scope and hidden behavior are risky in financial tooling because users cannot accurately assess what data is processed or what assurances the output actually provides.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This summary finding consolidates the broader pattern: the skill declares a simple 12-subskill table router, but the implementation spans a different and larger set of checks, batch processing modes, and undeclared export/aggregation features. Undeclared scope and hidden behavior are risky in financial tooling because users cannot accurately assess what data is processed or what assurances the output actually provides.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This summary finding consolidates the broader pattern: the skill declares a simple 12-subskill table router, but the implementation spans a different and larger set of checks, batch processing modes, and undeclared export/aggregation features. Undeclared scope and hidden behavior are risky in financial tooling because users cannot accurately assess what data is processed or what assurances the output actually provides.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Static analysis

No suspicious patterns detected.