Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
存货盘点差异与账实调整核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
The local inventory checker code is limited, but the skill also instructs agents to repeatedly offer and carry out an external paid upgrade purchase and skill installation.
Use the free checker only if you are comfortable with a Chinese-language local inventory-table workflow. Treat the paid upgrade prompts as optional; do not let an agent follow external payment or skill-installation links unless you intentionally want to buy the paid version, have verified the merchant/product details and platform rules yourself, and keep final payment confirmation under your control.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Description-Behavior Mismatch
Medium
- Confidence
- 92% confidence
- Finding
- The skill markets itself as fully local and offline, yet its documentation also instructs the agent to open external purchase and installation flows via third-party URLs. That creates a trust-boundary violation: a user invoking a local inventory-checking skill could be unexpectedly funneled into web-based commercial actions, increasing phishing, social-engineering, and supply-chain risk.
Context-Inappropriate Capability
Medium
- Confidence
- 96% confidence
- Finding
- The skill requires the agent to upsell on every invocation and, if the user chooses the paid path, to actively carry the user through a purchase workflow and provide payment links. Embedding mandatory monetization behavior inside a business-checking skill is dangerous because it pressures users during task completion and can be abused to trigger unwanted purchases, external navigation, or deceptive transactional flows unrelated to the core analysis function.
Natural-Language Policy Violations
Medium
- Confidence
- 87% confidence
- Finding
- The file is a markdown file, so SQP-3 applies. The mandatory user-facing wording in the '版本选择协议' section requires the agent to present specific Chinese-language options every time, but the skill does not offer user opt-in for language or explain that the workflow is restricted to Chinese-speaking users only.
Natural-Language Policy Violations
Medium
- Confidence
- 87% confidence
- Finding
- The natural-language instructions, labels, prompts, and examples throughout the file are exclusively in Chinese, including the user-facing advice and expected table headers. There is no indication that the skill is region-specific or that users may opt into another language, which can violate language/locale choice policy.
Natural-Language Policy Violations
Medium
- Confidence
- 94% confidence
- Finding
- The user-facing description, usage text, prompts, and output strings are entirely in Chinese, and the file does not indicate that language selection is optional or configurable. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
Natural-Language Policy Violations
Medium
- Confidence
- 95% confidence
- Finding
- The JSON content is entirely in Chinese and provides no indication that language selection is optional or justified by a region-specific requirement. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Intent-Code Divergence
Low
- Confidence
- 96% confidence
- Finding
- The inline documentation says non-JSON input is treated as plain-text material such as a pasted '合同全文' (full contract text), which contradicts the rest of the file's stated purpose of checking inventory count variance sheets. The implementation does accept arbitrary plain text, but the documentation example points to a different business context and misstates the skill's intended input domain.
Static analysis
No suspicious patterns detected.