ClawHub
Back to skill

Security audit

人力法定费用技能包（免费版）

Security checks for vulnerabilities and agentic risk

Overview

This is a local HR statutory-cost checker that reads user-provided materials and prints results, with no evidence of network use, persistence, or hidden execution.

Install only if you are comfortable giving the skill local access to the HR/finance materials you explicitly pass to it. Treat it as an arithmetic and reconciliation aid, not legal, tax, audit, or filing advice, and review the reported checks_not_run/sub_checks_not_run before relying on a clean result.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (16)

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
The finding indicates the free version's documented scope and output format materially differ from actual behavior, including missing declared checks and extra undocumented checks. While this is not code execution risk, it is a trust and integrity issue: users may make compliance decisions based on misunderstood coverage and incomplete evidence trails.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The finding indicates the free version's documented scope and output format materially differ from actual behavior, including missing declared checks and extra undocumented checks. While this is not code execution risk, it is a trust and integrity issue: users may make compliance decisions based on misunderstood coverage and incomplete evidence trails.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The finding indicates the free version's documented scope and output format materially differ from actual behavior, including missing declared checks and extra undocumented checks. While this is not code execution risk, it is a trust and integrity issue: users may make compliance decisions based on misunderstood coverage and incomplete evidence trails.

Ae1

High
Category
analysis-evasion
Content
node scripts/run.mjs --sample # 单公司样例（内置，3 项全跑）
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
node scripts/run.mjs --sample # 单公司样例（内置，3 项全跑）
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
node scripts/run.mjs --sample # 单公司样例（内置，3 项全跑）
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
node scripts/run.mjs --sample # 单公司样例（内置，3 项全跑）
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The manifest states the free version executes 3 items and explicitly includes 残疾人就业保障金核对. However, this module lists both `残保金勾稽` and `残保金计提与应缴不符检测` under `CHECKS_WITHHELD`, and the `run` function never executes disability-fund validation logic, only union-related and generic table checks.

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
This code embeds its skill description, required-field guidance, and user-facing messages entirely in Chinese, and the runtime outputs later in the file follow the same pattern. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless clearly documented as a justified region-specific constraint.

Natural-Language Policy Violations

Medium
Confidence
98% confidence
Finding
The file’s natural-language comments, user-facing messages, sample input, advice, disclaimer, and result note are all written in Chinese, and there is no indication that another language is supported or that the user can opt in to this locale. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The manifest says the free edition only performs 3 statutory checks: 残疾人就业保障金核对、工会经费计提与上缴核对、职工福利费与教育经费限额核对. This file's own documentation and exported scope show the free tier executes 6 checks, including 合计行复核、重复期间检测、空白与占位符检测、工资总额为负或为零检测, which go beyond the manifest's stated free-scope description.

Intent-Code Divergence

Medium
Confidence
87% confidence
Finding
The header comment says `免费档执行 6 项`, while the skill manifest says the free package only executes 3 items, and specifically frames the free scope around three statutory categories. This is an active documentation contradiction about user-visible scope, not a mere omission.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The code advertises 6 free checks and references the 2% union-fee statutory limit, but the implementation only runs welfare-limit, education-limit, totals, duplicate, blank, and negative-value checks. This mismatch can cause users to rely on a control that is not actually enforced, leading to undetected compliance errors and incorrect downstream conclusions.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The disclaimer states the tool checks '实际发生额 vs 限额', but no code performs that comparison in this free version. In a financial/compliance skill, overstating what validations were performed can mislead operators into trusting a result that omitted a material control, allowing excess amounts or required tax adjustments to go unnoticed.

Natural-Language Policy Violations

Low
Confidence
91% confidence
Finding
The file uses Chinese for the primary display name, summary, and description fields, and the main body of the README is also Chinese. Although English metadata exists, the skill does not explicitly offer a user-facing language/locale choice or opt-in, which can be interpreted as forcing a specific language experience.

Natural-Language Policy Violations

Low
Confidence
85% confidence
Finding
The file’s natural-language guidance, warnings, labels, and user-facing messages are entirely in Chinese, with no indication that the skill supports other languages or that Chinese is a required locale. This can violate a language/locale policy when users are not offered a choice or explicit opt-in.

Static analysis

No suspicious patterns detected.