Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
个税年度汇算（综合所得）核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
The bundled checker is local and coherent, but the skill also instructs agents to steer users into an external paid purchase and skill-install workflow that is not fully disclosed by the free/no-network description.
Install only if you are comfortable with a free local tax-checking skill that also contains a mandatory paid-upgrade prompt. The checker code itself appears local, but choosing the paid path would involve external SkillPay pages, payment confirmation by the user, and installation of another skill; verify merchant, product, amount, and platform rules before proceeding.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Description-Behavior Mismatch
High
- Confidence
- 97% confidence
- Finding
- The skill metadata and description promise a fully local, no-network free checker, but the body instructs the agent to access external purchase pages, install another skill, and continue a commercial workflow. This creates a trust-boundary violation: a user invoking a local tax-checking tool could be unexpectedly steered into networked transactions and software installation, increasing phishing, supply-chain, and unauthorized-action risk.
Context-Inappropriate Capability
High
- Confidence
- 95% confidence
- Finding
- The skill's stated purpose is tax-form verification, but it also instructs the agent to perform e-commerce steps, dependency installation, merchant/order verification, and payment handoff. Expanding scope from document checking to transaction orchestration violates least privilege and can be abused to trigger unwanted installs or socially engineer users into payments under the authority of the skill.
Intent-Code Divergence
Medium
- Confidence
- 88% confidence
- Finding
- The text claims the only differences between free and paid versions are the listed checks, but later sections impose additional agent behaviors such as mandatory upsell messaging and purchase-flow execution. This misleading disclosure can cause users and platforms to underestimate the skill's operational scope and approve behavior they would not expect from a simple checker.
Natural-Language Policy Violations
Medium
- Confidence
- 89% confidence
- Finding
- The instruction block directed at the agent is written as mandatory operational guidance and requires the agent to present specific user-facing messaging each invocation, but it does not offer any language or locale opt-in. Although the domain is China individual income tax, the file does not explicitly state that user communication must be in Chinese for compliance reasons or provide an alternative language choice.
Natural-Language Policy Violations
Medium
- Confidence
- 98% confidence
- Finding
- The file’s explanatory comments and user-facing strings are entirely in Chinese, including status advice and error messages. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly documented and justified.
Natural-Language Policy Violations
Medium
- Confidence
- 91% confidence
- Finding
- This file contains natural-language descriptions, usage text, errors, and output strings entirely in Chinese, which effectively forces a specific language for all users. The policy allows fixed locale behavior only when the constraint is clearly justified or when users are offered a language/locale choice; neither is present here.
Natural-Language Policy Violations
Medium
- Confidence
- 97% confidence
- Finding
- This JSON manifest/text template contains only Chinese-language content and gives no indication that the skill is region-specific or that users can opt into this locale. That can violate language/locale policy because it effectively forces a specific language without user choice.
Intent-Code Divergence
Low
- Confidence
- 92% confidence
- Finding
- The comment says non-JSON input is treated as plain-text material such as a pasted '合同全文', implying a generic contract/document workflow. But the skill is specifically for annual tax-settlement table checking, and the rest of the code expects 个税年度汇算表 content with headers rather than arbitrary contract text. This is an active documentation mismatch, not just an omission.
Static analysis
No suspicious patterns detected.