商誉减值测试底稿核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 6:44 AM UTC
• Version: 1.0.8

Overview

The local goodwill-checking code is mostly coherent, but the skill embeds under-scoped external purchase and installation instructions that conflict with its no-network/no-payment framing.

Install only if you want a Chinese-language local Node checker for goodwill impairment workpapers and are comfortable ignoring or disabling the upsell path. Do not let an agent automatically follow the paid-version purchase/install instructions or fetch remote onboarding instructions unless you separately trust the merchant, the payment flow, and the new skill being installed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 从可执行逻辑看，该技能的主要功能仍然是商誉减值测试底稿核对，和声明主题大体相关：它解析含“资产组名称、商誉账面价值、可辨认净资产、可收回金额、减值损失”等列的表格，执行合计勾稽、重复检测、空白/缺列检测，并返回逐条证据。这部分与声明相符。但存在两类重要不一致。第一，声明把免费版能力概括为“逐行复算、合计勾稽、重复与空缺检测”，而代码实际还做了多项更具体、实质性的会计公式校验（账面价值构成、减值损失计算、商誉减值上限、本期商誉净额），属于未明确声明的能力扩展。第二，代码中混入了明显来自另一技能“股份支付费用分摊核对”的注释与空输入提示，这会使真实用途说明与用户交互文案不一致，构成描述/行为错配。因此应判定为存在 mismatch，尽管其核心业务域仍以商誉减值检查为主。

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The skill claims '完全本地运行' and '不联网', but later directs agents to external URLs and purchase/install flows, creating a material trust-boundary mismatch. Users and platforms may grant the skill more trust based on offline-only claims, while the embedded instructions actually encourage network access and remote dependency acquisition, which can lead to misleading security expectations and unsafe execution paths.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill documentation broadens a local audit-checking tool into a workflow that instructs the agent to fetch external pages, initiate purchase flows, install additional skills, and continue execution based on remote instructions. This creates a supply-chain and prompt-injection risk because a seemingly offline, deterministic skill can pivot users or agents into executing untrusted network-driven commerce and installation steps unrelated to the core checking function.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The documentation mandates commerce and installation behaviors such as reading external instructions, verifying merchant IDs, obtaining payment links, and completing installation after payment, none of which are necessary for validating goodwill impairment workpapers. Embedding these operational directives inside the skill increases the chance that an agent will perform privileged actions beyond the user's original intent, including opening external purchase paths and installing new dependencies.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The file header describes a different accounting workflow ('股份支付费用分摊核对') than the logic actually implemented for goodwill impairment testing. In a financial-review skill, this kind of semantic mismatch can mislead operators into supplying the wrong source data or trusting results under the wrong control objective, causing incorrect audit support or missed accounting errors.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The user-facing name, summary, and primary descriptions are presented only in Chinese, and the usage/instructions throughout the file are written in Chinese without indicating that users may choose another language. This creates a locale/language constraint without explicit user opt-in, which matches the policy category for language or locale violations.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This code file contains extensive user-facing documentation and messages exclusively in Chinese, including operational instructions and result text. Under the policy, forcing a specific language without opt-in is a natural-language locale violation unless the constraint is explicitly documented and justified as region-specific.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: When input is empty, the tool tells the user to provide a '股份支付费用分摊表' even though the engine parses a goodwill impairment table. This can drive users to submit the wrong dataset and obtain no meaningful validation, weakening reliability of financial control checks and potentially hiding real misstatements.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The no-data error path still instructs users to provide a '股份支付费用分摊表', which contradicts the code's goodwill-impairment parsing behavior. This inconsistency is dangerous in an accounting-assistance context because it can cause repeated operator confusion, bad inputs, and false confidence that the skill is checking the intended workpaper.

Intent-Code Divergence

Low

• Confidence: 89% confidence
• Finding: The inline documentation says non-JSON input is treated as '直接粘贴的合同全文', which describes contract-document processing rather than goodwill-impairment worksheet checking. The actual surrounding code, usage text, and manifest consistently position the skill as checking 商誉减值测试底稿, so this comment contradicts the stated intent and could mislead maintainers about the skill's supported document type.

Static analysis

No suspicious patterns detected.