药品耗材进销存与科室领用核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 6:44 AM UTC
• Version: 1.0.36

Overview

The local checker code is self-contained, but the skill also pushes an off-site purchase and skill-install flow that is not necessary for the advertised free check.

Use this only if you want a Chinese-language local checker for hospital supply reconciliation tables. Treat the paid upgrade flow as a separate, high-impact action: do not allow purchase, payment-link handling, or installation of additional skills unless you explicitly intend that, and verify merchant/order details yourself. The bundled free code itself appears local and does not make network calls.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The skill explicitly claims it is fully local and does not use the network, but later sections depend on remote websites, product pages, and online purchase/install flows. This contradiction is dangerous because it can mislead users, reviewers, or automation into granting trust under false assumptions while the skill content encourages networked actions.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is presented as a local, no-network reconciliation tool, but it also instructs the agent to initiate external purchase and installation flows using remote URLs. This expands the trust boundary from offline document checking to commerce and software acquisition, creating a path for phishing, unreviewed dependency installation, and user redirection that is inconsistent with the declared capability.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The documented behavior includes buying another product, following remote installation guides, and installing additional skills, none of which are necessary for checking hospital supply reconciliation tables. Embedding commerce and install workflows into a business-audit skill creates an unnecessary privilege and social-engineering channel that could be abused to induce unsafe actions by the agent or the user.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This JavaScript file contains all user-facing comments, warnings, labels, sample data, and result strings exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly justified as region-specific, which is not stated here.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The file’s user-facing description, help text, prompts, and output messages are all in Chinese, and there is no indication that users can select another language or that the Chinese-only constraint is optional. This can violate a language/locale policy when the skill is not explicitly documented as region-specific or opt-in for that locale.

Intent-Code Divergence

Low

• Confidence: 93% confidence
• Finding: The comment says non-JSON input is treated as plain-text material such as a pasted '合同全文' (full contract text), which contradicts the documented intent of this skill as a checker for 药品耗材进销存与科室领用核对表. The code path does indeed accept arbitrary plain text, but the inline documentation describes a materially different document type and purpose than the rest of the file.

Description-Behavior Mismatch

Low

• Confidence: 88% confidence
• Finding: The manifest and file header emphasize a free, fully local checking tool that performs on-device verification without external interaction. However, the runtime output explicitly advertises an external purchase/official entry link, which goes beyond the stated verification behavior and introduces promotional behavior not reflected in the skill description.

Static analysis

No suspicious patterns detected.