Security audit

租赁与递延收益技能包（免费版）

Security checks for vulnerabilities and agentic risk

Overview

This is a local accounting worksheet checker that reads user-provided files and prints results without network use, persistence, or hidden privilege behavior.

Install only if you are comfortable running a local Chinese-language accounting checker on exported worksheet text. Treat its output as arithmetic and consistency review, not audit, tax, or accounting judgment; pay attention to checks explicitly listed as not run, especially free-version withheld sub-checks.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the tool actually runs a different set of checks, on different data structures, and without the claimed original-file line references, users can treat the results as contract-level verification when they are only table-level consistency checks. In an accounting-review context, that can cause silent control gaps: missing issues may be assumed checked, while unsupported findings may be treated as evidence.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If the tool actually runs a different set of checks, on different data structures, and without the claimed original-file line references, users can treat the results as contract-level verification when they are only table-level consistency checks. In an accounting-review context, that can cause silent control gaps: missing issues may be assumed checked, while unsupported findings may be treated as evidence.

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 单合同样例（内置，2 项全跑）
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 单合同样例（内置，2 项全跑）
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 单合同样例（内置，2 项全跑）
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 单合同样例（内置，2 项全跑）
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The file’s user-facing comments and instructions are entirely in Chinese and present the workflow, constraints, and warnings only in that language. This creates a natural-language locale constraint without any opt-in, alternative language handling, or documentation that the skill is intentionally region/language-specific.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The file’s natural-language comments and user-facing guidance are entirely in Chinese, including operational disclaimers and input instructions. The policy flags language/locale constraints when a skill effectively requires a specific language without user opt-in or an explicitly documented regional justification.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The disclaimer states that the tool checks the interest-rate relation (`利息 = 期初 × 折现率`), but the free-version code explicitly withholds that check. This can mislead users into believing a key validation was performed when it was not, causing false assurance in financial review results and potentially allowing erroneous schedules to pass unnoticed.

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: The script’s help text, status messages, and result formatting are hard-coded in Chinese with no language-selection mechanism, which can cause users to misunderstand inputs, warnings, findings, or exit conditions. In a contract-review/security-adjacent workflow, misunderstanding output can lead to missed issues or incorrect operational decisions, especially for non-Chinese-speaking operators.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The only natural-language content in this file is entirely in Chinese, including the headings and tabular labels, with no indication that the skill is region-specific or that users may select another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.

Static analysis

No suspicious patterns detected.