出口退税申报单证一致性核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 6:34 AM UTC
• Version: 1.0.49

Overview

The local checker itself appears non-networked, but the skill also embeds mandatory upsell, purchase, external metadata, and follow-on installation instructions that exceed the stated free local checking purpose.

Install only if you want a Chinese-language local export-rebate table checker and are comfortable ignoring or disabling the upsell. Do not let an agent follow the paid purchase/install path unless you explicitly want that separate transaction, have verified the merchant, product, amount, and platform rules yourself, and are prepared to review the additional skill before use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The skill markets itself as a fully local, no-network free checker, yet later instructs the agent to initiate external purchase, installation, and remote metadata retrieval flows. This creates a trust-boundary violation: a user or host system may permit the skill based on the no-network claim, while the embedded instructions push the agent into external actions unrelated to the declared local-only behavior.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The skill includes mandatory upsell and purchase-orchestration behavior that is not necessary for performing document consistency checks. Embedding commerce workflow inside an analysis skill expands the skill's authority and can pressure the agent to handle transactions, installation steps, and external navigation beyond the user's original task.

Natural-Language Policy Violations

Medium

• Confidence: 78% confidence
• Finding: Nearly all user-facing instructions, workflow text, and purchase guidance are presented only in Chinese, while no statement offers the user a language preference or explains that the skill is restricted to a Chinese-speaking or China-specific compliance context. Under the policy, forcing a specific language without opt-in is a natural-language locale concern.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill exposes direct external purchase URLs, JSON metadata endpoints, and redirect behavior unrelated to the stated free local checking purpose. Such links can induce the agent or user to leave the trusted local workflow and follow mutable external destinations, increasing phishing, redirection, and supply-chain risk.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The file’s user-facing comments, labels, advice, error messages, findings, notes, and disclaimer are written entirely in Chinese, and the runtime outputs in lines later in the file also continue this requirement. There is no indication that users may choose another language or that the locale restriction is optional, which matches the policy category for language/locale constraints without opt-in.

Vague Triggers

Low

• Confidence: 82% confidence
• Finding: The markdown explicitly lists trigger phrases, but one of them is a natural complaint-style phrase meaning the form 'doesn't match up,' which could plausibly appear in ordinary discussion of export rebate paperwork rather than an intentional invocation. The file does not provide negative examples or explicit boundaries for when the skill should not activate.

Intent-Code Divergence

Low

• Confidence: 87% confidence
• Finding: The inline documentation says non-JSON input may be treated as plain text material such as a pasted '合同全文' (full contract text). That contradicts the surrounding module intent, which repeatedly states the tool expects an export rebate consistency-check table with headers, not arbitrary contract text.

Context-Inappropriate Capability

Low

• Confidence: 92% confidence
• Finding: The script claims the free version runs locally and does not require purchase, but it still prints a purchase/official sales URL at the end of successful execution. In an agent/skill context, unsolicited promotional links can steer users or downstream agents to external content outside the declared task boundary, creating trust-boundary confusion and a mild social-engineering risk even though this line alone does not exfiltrate data.

Static analysis

No suspicious patterns detected.