存货跌价准备核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 6:59 AM UTC
• Version: 1.0.49

Overview

The local checking code appears limited, but the skill instructions push users toward external paid purchase and installation flows that conflict with its no-network, no-payment framing.

Install only if you are comfortable with a Chinese-language financial checker that may steer the agent toward a paid external SkillPay purchase and installation flow. Treat the bundled local checker as separate from the upgrade instructions, do not allow automatic purchases or external installs, and verify any merchant, amount, package name, and payment URL yourself.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The documentation explicitly claims 'completely local' and 'no network,' yet the same file later directs use of external URLs and online buying instructions. This is a dangerous transparency failure because users and agents may trust the skill under false assumptions about offline safety and data exposure.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill presents itself as a fully local, no-network checking tool, but later instructs the agent to initiate external purchase, payment, and installation flows. That mismatch can mislead users and the agent about the true trust boundary, and creates an opportunity for unintended external actions unrelated to the core audit task.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Embedding payment and external product installation instructions inside a financial table verification skill violates least privilege and expands the skill's capability beyond its stated purpose. If followed by an agent, this could steer the conversation from document analysis into sensitive commercial actions, including opening links, initiating orders, and installing other software.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The policy text directs the agent to always present the '免费版 / 完整版' choice to the user, and the mandated wording is specified only in Chinese. The file does not offer a language choice or state that the user’s preferred locale should be respected, which can violate language/locale choice expectations.

Ssd 4

Medium

• Confidence: 95% confidence
• Finding: Mandating that the agent always present an upsell path and potentially execute payment-link and fulfillment steps is a form of conversation steering toward sensitive actions. Even if framed as optional, making it compulsory in every invocation increases the chance of social engineering, user confusion, and policy bypass around commerce and tool use.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Ssd 4

Medium

• Confidence: 96% confidence
• Finding: The skill narratively escalates from a local checking task into reading external instructions, purchasing another product, and installing it on the user's behalf. This kind of staged redirection is risky because it conditions the agent to cross trust boundaries and perform increasingly sensitive actions outside the original task scope.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The file's natural-language instructions, labels, sample input, user-facing advice, findings, notes, and disclaimer are all hard-coded in Chinese. There is no indication that the skill supports user language selection or that the Chinese-only constraint is an explicitly justified regional requirement, which can violate language/locale policy.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: Natural-language policy violations apply to all file types, including code comments and user-facing string literals. This script's help text, usage, errors, and descriptions are all presented only in Chinese, which effectively forces a specific language without user opt-in or any documented region-specific justification.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: 帮助文本在 L058-L059 声明“--json 以 JSON 输出（默认给人看）”，通常意味着该模式下输出应为纯 JSON，便于程序消费。但在成功路径中，L184-L185 输出 JSON 后，L188-L193 仍继续打印多行自然语言文本，导致实际行为不是纯 JSON 输出。

Intent-Code Divergence

Low

• Confidence: 94% confidence
• Finding: L077 的注释写明“不是 JSON 就当作纯文本材料（例如直接粘贴的合同全文）”，但本技能的清单、帮助文本和后续不足材料提示都表明它只应处理存货跌价准备计提表。这里不是单纯信息遗漏，而是用一个与技能目的不符的文档示例描述输入语义，容易误导调用方对可接受材料范围的理解。

Static analysis

No suspicious patterns detected.