Security audit

人力资源月度自查包（免费版）

Security checks for vulnerabilities and agentic risk

Overview

This is a local Chinese HR/payroll reconciliation skill that matches its stated purpose and shows no network, persistence, credential access, or data-changing behavior.

Install only if you want a Chinese-language, local-only HR/payroll checker and are comfortable pasting payroll or social-insurance tables into files processed on your machine. Treat the output as arithmetic reconciliation, not legal, tax, or compliance sign-off, and note that some checks are explicitly not included in the free version.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 描述把该技能表述为一个包含 3 类月度自查的免费版工具，但当前代码块只对应“工资表代扣与个税社保申报核对”这一子功能，且文件头部还明确写明‘本文件是免费档子集’。没有看到任何关于“工资个税累计预扣核对”或“社保公积金缴费基数核对”的实现逻辑，因此技能描述对整体能力有明显夸大。离线执行、可复算、不给材料不足时下结论等方面与描述基本一致，但核心功能覆盖范围不一致，属于实质性描述-行为不匹配。

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明把该技能描述成一个包含三类 HR 月度自查能力的免费版工具包，但本代码块的实际主功能是单一的个税“累计预扣法”核算校验引擎。代码中没有处理工资表代扣与个税/社保申报勾稽，也没有处理社保公积金缴费基数核对；输入结构、字段识别和计算逻辑都集中在个税累计预扣表。虽然这段代码与声明中的其中一类能力相符，但不足以支撑“免费版执行 3 类”的整体描述，因此属于描述与实际行为的实质性不一致。

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 代码注释已明确说明“本文件是免费档子集，只实现免费检查项；完整档（付费）的实现不在这个包里”，且 service_type 直接标识为 SOCIAL_INSURANCE_BASE_CHECK。其逻辑全部围绕社保/公积金缴费基数与缴费金额的算术校验展开，没有任何个税累计预扣、工资表代扣与个税社保申报比对等实现。因此，相比声明的“免费版共 3 类核对”，该代码块的实际能力明显更窄，属于描述与行为不一致。未发现额外越权、联网或与声明无关的敏感能力；问题主要是声明覆盖范围大于实际实现范围。

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 先看样例
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 先看样例
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Vague Triggers

Medium

Confidence: 99% confidence
Finding: An incomplete and overly broad trigger reference in the summary increases the chance of unintended routing or ambiguous invocation behavior. In this business-ops skill, accidental activation can expose or ingest confidential payroll information under the wrong workflow, creating privacy and data-handling risk even without malicious intent.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: Overly broad trigger phrases such as generic month-end or reconciliation terms can cause the skill to activate in unrelated conversations and process sensitive HR/payroll material unintentionally. In an HR context, accidental invocation is more dangerous because user prompts may contain payroll, tax, and social insurance data that should only be handled when the user explicitly intends to use this skill.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The file’s user-facing comments, guidance, labels, and output strings are entirely in Chinese, including instructions the user is expected to follow and messages returned by the skill. There is no indication that the skill is region-specific by design or that users can opt into a language/locale, which can violate a language-choice policy.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The file’s natural-language contract, descriptions, sample data, labels, and user-facing advice are all written in Chinese, indicating the skill is designed to operate in a single language/locale. There is no documented user choice or opt-in for language selection, which matches the policy’s language/locale violation criterion.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The file’s user-facing natural-language strings, comments, labels, instructions, and outputs are written entirely in Chinese, including required input guidance and result messages. There is no indication that the skill is region-specific by policy or that users may opt into another language, which creates a language/locale policy issue under the rule.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The disclaimer states that the tool checks whether employer and employee contribution bases are consistent, but that check is explicitly listed in CHECKS_WITHHELD and is not implemented in run(). This can mislead users into trusting a control that never ran, causing payroll or compliance discrepancies to go undetected in a finance/HR context where users may rely on the output for sign-off.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The JSON text is entirely in Chinese and presents payroll/tax/social-insurance verification content with no indication that the language is optional or region-specific by design. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: The skill’s visible name, summary, and main descriptions are primarily in Chinese, and the usage/documentation that governs operation is also predominantly Chinese. While an English display field exists, the file does not state that users can choose their language or that the Chinese-only operational instructions are a deliberate opt-in.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: L075 的注释写明“不是 JSON 就当作纯文本材料（例如直接粘贴的合同全文）”，其中“合同全文”与该技能在清单与帮助文本中反复声明的用途——人力资源月度自查、需分段且含表头的核对材料——不一致。代码本身只是把任意非 JSON 文件内容放入 text 字段，并未实现针对“合同全文”的相应能力，因此这属于文档/注释层面的意图表述偏离。

Static analysis

No suspicious patterns detected.