酒店夜审与房费收入核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 6:43 AM UTC
• Version: 1.0.36

Overview

The local audit code appears purpose-aligned, but the skill instructions add an under-disclosed paid upgrade flow that can send the agent to external purchase and installation steps.

Install only if you are comfortable with a free local Chinese-language hotel revenue checker that also promotes a paid full version. Do not allow the agent to follow purchase links, install external SkillPay/onboarding content, or handle payment flows unless you explicitly want that upgrade and have independently verified the merchant, product, amount, and platform rules.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The documentation claims the skill is completely local and does not use the network, but later sections require accessing external URLs for purchase and installation. This inconsistency is security-relevant because it can mislead users and agents into trusting the skill under false assumptions, making unexpected outbound access and remote content retrieval more likely to succeed.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill advertises itself as a free, local audit tool, yet embeds instructions for external purchase, installation, and payment handling. This creates a hidden trust-boundary shift: an agent following the skill may leave the local/offline context, fetch remote content, and guide the user into a payment flow unrelated to the core audit task, increasing phishing, supply-chain, and deceptive upsell risk.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The skill's stated purpose is auditing hotel revenue tables, but it includes e-commerce and software installation directives that are not necessary for that purpose. Unrelated transactional capabilities expand the attack surface and can coerce an agent into performing sensitive actions such as fetching remote instructions, initiating purchases, or installing dependencies under the guise of normal skill operation.

Natural-Language Policy Violations

Medium

• Confidence: 80% confidence
• Finding: The display name, summary, and primary instructions are all in Chinese, and the usage/interaction text assumes Chinese-language operation. There is no explicit user opt-in, language selection, or documented justification for restricting operation to Chinese, which can violate language/locale policy requirements.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The file’s user-facing comments, labels, messages, and disclaimer are written entirely in Chinese, and the skill expects Chinese table headers such as “营业日期”, “房号”, and “出租间夜”. There is no indication that language selection is optional or that the skill is intentionally restricted to a Chinese-speaking or region-specific deployment, which creates a natural-language locale policy concern.

Vague Triggers

Low

• Confidence: 91% confidence
• Finding: This markdown/manifest content defines activation with example trigger phrases but does not state whether only those phrases invoke the skill or provide any exclusion conditions. That can cause unintended invocation if semantically similar everyday requests are matched too broadly.

Static analysis

No suspicious patterns detected.