外贸月度自查包（免费版）

• Outcome: Pass
• Latest audit: Sep 20, 2026 · 1:32 PM UTC
• Version: 1.0.53

Overview

This is a local Chinese-language accounting self-check skill that reads user-provided table data and performs deterministic checks without network access, persistence, or hidden privileged behavior.

Install only if you want a Chinese-language, local-only checker for copied/exported foreign-trade accounting tables. It does not read ERP, XLSX, bank PDFs, or online tax/FX data directly, and its outputs should be treated as arithmetic consistency checks rather than tax, accounting, or compliance advice.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: 描述承诺的是一个包含 3 类月度自查能力的免费版工具包，但该代码文件只覆盖其中 1 类，即出口退税核算核对。代码中的检查项全部围绕免抵退计算表展开，包括不得免征和抵扣税额、免抵退税额、应退税额、免抵税额、合计复核、重复报关单号和空白检测；同时注释和 OUT_OF_SCOPE 还明确排除了收汇/单证/备案等退税条件判断，更没有任何外币结算或汇兑损益计算逻辑。因此，代码实际行为与整体描述存在实质性能力缺口。未发现越权访问、联网或其他额外未声明的危险能力；问题主要是描述覆盖面大于本代码实际实现范围。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: 代码头部和实现都表明这是“出口报关与收汇核销核对”的单一模块。其核心逻辑仅围绕报关金额、佣金率、应收外汇、已收汇、核销差额等列做内部勾稽复算与格式/异常检查，返回的 service_type 也是 EXPORT_FX_COLLECTION_CHECK。没有看到任何关于出口退税核算的税额/退税率/进项对应关系计算，也没有任何关于外币结算与汇兑损益的汇率折算、汇兑损益计算或相关核对逻辑。因此，实际行为明显小于且不同于声明的“3 类核对免费包”。虽无越权访问或隐藏资源使用，但主要能力描述与代码实现范围存在实质性不一致。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: 从代码注释、字段设计和校验逻辑看，该文件明确是“外币结算与汇兑损益核对引擎”。它要求含有‘外币金额、记账汇率、记账本位币、结算汇率、结算本位币、汇兑损益、已收本位币’等表头，并执行相应勾稽、合计复核、重复单据号和空白检测。这与声明中的第三类检查相符。但声明整体描述的是一个免费版自查包，明确说免费版执行 3 类核对；而给定代码块只覆盖其中一类，且没有任何出口退税、报关、收汇核销相关字段或逻辑。因此，若将该代码块视为对该声明能力的实现，则描述范围大于实际行为，构成实质性不匹配。未发现额外越权、联网或资源访问方面的未声明能力。

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Natural-Language Policy Violations

Medium

• Confidence: 78% confidence
• Finding: The primary display name, summary, and operational description are written exclusively in Chinese, and the usage examples and trigger phrases are Chinese-only, which implies a fixed language expectation. Although an English field exists, it does not clearly offer the user a language choice or state that the skill is intentionally limited to a Chinese-speaking regulatory/accounting context.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The description lists trigger phrases such as “月底核对”, “月度自查”, and especially “对不上怎么办”, which are broad expressions a user might say in many ordinary accounting or troubleshooting contexts. The file does not provide exclusion conditions or negative examples to clarify when the skill should or should not activate.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This JavaScript file contains its top-level description, sample data, advice strings, error messages, and result notes entirely in Chinese, indicating the skill is designed to operate in a single language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not stated here.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The file’s user-facing comments and descriptive strings are entirely in Chinese, including warnings, instructions, and output text, with no indication that the user can choose another language. Under the stated policy, forcing a specific language or locale without opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: This JavaScript file embeds its descriptive contract, scope notes, sample headers, and user-facing guidance entirely in Chinese. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is explicitly justified, which is not documented here.

Static analysis

No suspicious patterns detected.