集团财务月度自查包（免费版）

• Outcome: Pass
• Latest audit: Sep 20, 2026 · 12:32 PM UTC
• Version: 1.0.49

Overview

This skill is a local Chinese-language finance self-check tool that reads user-provided reconciliation data and reports arithmetic issues without network use or persistence.

Install only if you want a Chinese-language, local finance-table arithmetic checker. Review outputs as reconciliation aids, not accounting, audit, tax, or legal conclusions, and run it only on files you intentionally provide to the Node script.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: A skill presented as a three-part monthly review but implemented as only AR aging creates control-gap risk: users may stop additional review work based on incomplete coverage. In business-ops skills, deceptive or inaccurate capability claims are particularly harmful because they influence financial decisions and period-close signoff.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: A skill presented as a three-part monthly review but implemented as only AR aging creates control-gap risk: users may stop additional review work based on incomplete coverage. In business-ops skills, deceptive or inaccurate capability claims are particularly harmful because they influence financial decisions and period-close signoff.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: A skill presented as a three-part monthly review but implemented as only AR aging creates control-gap risk: users may stop additional review work based on incomplete coverage. In business-ops skills, deceptive or inaccurate capability claims are particularly harmful because they influence financial decisions and period-close signoff.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: An ambiguous trigger in the summary broadens activation beyond the intended reconciliation package. In combination with available tools, even a low-severity activation bug can lead to unnecessary file access or execution paths in routine finance conversations.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: Overly broad trigger phrases can cause the skill to activate during ordinary finance discussions unrelated to this specific self-check workflow. That increases the chance of accidental invocation, inappropriate tool use, and user confusion about which workflow is in effect.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The skill claims to be fully local and no-network, yet it allows Bash and documents shell-based execution. Bash is a highly privileged tool that can read arbitrary local files, spawn processes, and access the network, so the declared trust boundary is broader than represented to users.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The file’s natural-language instructions, input requirements, missing-input advice, sample data, and disclaimer are all written exclusively in Chinese, and the expected section headers are Chinese-only. There is no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking or China-specific compliance context.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This JavaScript file contains natural-language comments, prompts, advice, notes, and disclaimers entirely in Chinese, including the user-facing messages returned by `run()`. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which it is not here.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This JavaScript file embeds its descriptive comments, sample data, column labels, error/advice text, and result summaries entirely in Chinese. That creates a locale/language constraint for users and downstream consumers without any documented opt-in or alternative language choice, which matches the policy's language/locale violation criterion.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This JavaScript file contains its primary docstring, labels, sample input, and user-facing messages entirely in Chinese, indicating the skill is designed to operate in a single language. There is no opt-in, locale selection, or explicit justification that the skill is region-specific, which can violate language/locale policy requirements.

Intent-Code Divergence

Low

• Confidence: 97% confidence
• Finding: The module documentation says input may contain a section headed `=== 银行流水对账 ===`, but the implementation only recognizes the three names in `BUNDLE_CHECKS`: 集团内部往来对账与抵消核对、供应商应付对账、应收账款账龄核对. This is an active documentation/code mismatch because a user following the documented example would provide a section the code never runs.

Static analysis

No suspicious patterns detected.