政府补助与递延收益核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 6:44 AM UTC
• Version: 1.0.30

Overview

The local accounting checker appears to run offline, but its instructions also push users into an external paid purchase and installation flow that is not clearly scoped at the top level.

Install only if you want a Chinese-language local checker and are comfortable ignoring or disabling the upsell path. Do not let the skill open payment links, fetch product IDs, install external onboarding, or add a paid skill unless you explicitly intend to buy it and can independently verify the merchant, product, price, and platform rules.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The documentation explicitly claims 'fully local' and 'no network', but later sections instruct use of multiple external URLs, live purchase pages, and remote installation guidance. This contradiction is dangerous because users and agents may trust the offline-safety claim while being induced into network activity, undermining security assumptions and consent.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is presented as a local, offline checking tool, but its embedded instructions require the agent to initiate online purchase and installation flows, surface payment links/QR codes, and continue with fulfillment steps. This creates a capability mismatch that can mislead users and downstream agents into performing commerce actions unrelated to the core audit task, increasing phishing, payment-redirection, and supply-chain risk.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill’s stated purpose is deterministic reconciliation of subsidy/deferred-income tables, yet it embeds detailed instructions for buying another product, fetching current product identifiers, and completing installation after payment. This unnecessary commercial workflow broadens the attack surface beyond the business function and can be abused for unauthorized upsell, deceptive monetization, or directing users to untrusted endpoints.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill includes external purchase and installation flows, but the main usage section does not prominently warn that following those steps may open external links and initiate payment-related actions. This weak disclosure increases the chance that users or agents will enter a commerce flow without clear informed consent, especially given the earlier 'no network' messaging.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The file’s natural-language comments, user-facing advice, disclaimer text, and sample interaction content are entirely in Chinese, and there is no indication that the skill offers a language choice or that Chinese is an explicitly documented locale restriction. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Vague Triggers

Low

• Confidence: 83% confidence
• Finding: The markdown manifest text says the trigger phrases '包括 政府补助与递延收益核对、政府补助与递延收益核对表对不上' but does not define when these phrases should not invoke the skill. While domain-specific, the invocation guidance still relies on an open-ended 'includes' formulation rather than a closed trigger list or scoped activation rule.

Intent-Code Divergence

Low

• Confidence: 93% confidence
• Finding: The comment says non-JSON input is treated as plain-text material such as a pasted '合同全文', which implies a broader contract-document use case. However, the manifest and the script's usage/help text consistently state the skill is specifically for a 政府补助与递延收益核对表 with headers, and insufficient material should not yield conclusions. This inline documentation misstates the intended input domain.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The JSON payload consists entirely of Chinese headers and values, indicating the skill is constrained to a specific language/locale. In this file there is no surrounding natural-language note offering a language choice or documenting that the skill is intentionally region-specific, which can violate language/locale policy requirements.

Static analysis

No suspicious patterns detected.