Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看样例
Security audit
出口退税核算核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local Chinese export VAT rebate worksheet checker that reads user-provided files and performs disclosed deterministic checks without network, persistence, or hidden behavior.
Install only if you need a Chinese-language local checker for export VAT rebate calculation worksheets. It does not validate the legally correct rebate rate or eligibility conditions, and broad trigger wording may make it appear during general discussions of rebate rates.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看样例
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest description says the skill is triggered by phrases including “退税率”, which is a generic tax-related term rather than a specific invocation. Because this term can appear in ordinary discussion of export tax topics, it risks unintended activation without clear scope constraints or negative examples.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file's user-facing description, sample input schema, error advice, and result messages are all written in Chinese, indicating the skill expects and responds in a single language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless a locale constraint is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The JSON template consists entirely of Chinese column headers and values, indicating the skill output is fixed to a specific language/locale. There is no accompanying natural-language indication that this is optional, user-selected, or required for a documented region-specific use case.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s natural-language interface, including the header comment, usage text, errors, and status messages, is entirely in Chinese. There is no indication that users can opt into another language or that the skill is restricted to a Chinese-only context, which can violate a language/locale policy requiring user choice or documented justification.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The comment says non-JSON input is treated as plain text material and gives '直接粘贴的合同全文' as the example, which contradicts the manifest and the rest of the file that consistently require an export rebate calculation table with headers. This is not just incomplete documentation: it actively describes a different document type than the code's stated skill purpose.
- Content