集团内部往来对账与抵消核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 6:44 AM UTC
• Version: 1.0.41

Overview

The local reconciliation checker itself is narrow, but its skill instructions push an agent into external purchase and installation flows that are not needed for the stated local task.

Install only if you are comfortable with a Chinese-language local checker that also contains built-in paid-upgrade instructions. Do not let an agent follow the purchase or installation links unless you intentionally want the paid product, have verified the merchant/product details yourself, and understand any platform rules about external payment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The documentation explicitly says the skill is 'completely local' and 'does not network,' but other sections direct the agent to online resources, purchase pages, and external installation guides. This contradiction is dangerous because it misrepresents the skill's behavior and can defeat user or platform security assumptions about offline-only execution.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill markets itself as a fully local, no-network reconciliation checker, but later instructs the agent to carry out online purchase and installation flows using external links and dynamic product data. This creates a trust-boundary violation: an agent or user may rely on the 'local only' claim while being steered into network actions unrelated to the core reconciliation task, increasing phishing, supply-chain, and unauthorized transaction risk.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The embedded commercial workflow is not necessary to perform the stated reconciliation function and pressures the agent to initiate purchases, retrieve links, and continue installation after payment. Mixing business logic with monetization instructions can manipulate agent behavior, expand the attack surface, and cause users to be routed into external payment flows under the guise of a local checking tool.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The operational instructions to the agent are written entirely in Chinese and direct the agent to present required upsell and purchase-flow text to users in that form, with no opt-in or alternative locale path. This creates a language/locale constraint that is not documented as region-specific or optional, which fits the policy-violation category.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Ssd 4

Medium

• Confidence: 94% confidence
• Finding: The 'official instruction' block incrementally moves from installation guidance into instructing the agent to initiate a purchase for a specific merchant and product. Even though it tells the agent not to confirm payment, it still normalizes agent-led transaction setup and external dependency installation, which can be abused for unwanted purchases, social engineering, or supply-chain exposure.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The file’s user-facing documentation and messages are written entirely in Chinese, including instructions, warnings, and output strings, with no indication that the user can choose another language or that the skill is restricted to a Chinese-speaking or China-specific deployment. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file's help text, status messages, and documentation are entirely in Chinese, including the capability description and command usage output. This imposes a specific language on users without opt-in or an alternative locale, which matches the policy's language/locale violation criterion.

Intent-Code Divergence

Low

• Confidence: 89% confidence
• Finding: L077 的注释写明“不是 JSON 就当作纯文本材料（例如直接粘贴的合同全文）”，但该技能清单与其余帮助文本均说明它用于“集团内部往来对账与抵消核对表”且要求含表头。这里的文档示例把合同全文描述成可接受材料，主动传达了比实际技能目的更宽的输入意图，属于文档与技能意图的矛盾。

Static analysis

No suspicious patterns detected.