低值易耗品与周转材料摊销核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 9:30 AM UTC
• Version: 1.0.6

Overview

The included checker appears local, but the skill also tells agents to promote and carry out an external paid install/payment flow.

Review the paid-upgrade instructions carefully before installing. The free bundled script appears local and non-networked, but do not allow the agent to start the SkillPay purchase/install flow unless you explicitly intend to buy and install another skill; consider disabling the upsell with SKILL_NO_UPSELL=1 and verify merchant, product, amount, and platform rules yourself.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The file makes strong assurances such as 'completely local' and 'no network', but later content requires visiting external URLs and completing an online purchase/install process. This contradiction is dangerous because it can mislead users, downstream policy engines, or autonomous agents into granting trust or permissions under false assumptions, then expose them to network, payment, and installation risks.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The visible skill name, summary, primary descriptions, and trigger phrases are all presented in Chinese, and the operational instructions in the body also assume Chinese usage. Although an English description exists at L013, the skill does not offer an explicit user language/locale choice or opt-in for response language, which matches the language-policy violation criteria.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill presents itself as a fully local, no-network free checker, yet it also embeds instructions directing the agent to initiate an external purchase and installation flow for a paid version. This creates a trust-boundary violation: an agent or user may rely on the local-only claim while being steered into network activity, software installation, and a payment workflow that are outside the core checking function.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill includes commerce and software-installation instructions that are not necessary to perform ledger verification. Embedding these actions in operational instructions increases the risk of prompt-injected behavior, supply-chain exposure, and unintended redirection from a read/analysis task into acquisition and installation of external software.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file’s user-facing documentation and instructional strings are entirely in Chinese, including required input guidance and result messages, with no indication that users may choose another language. This creates a language/locale policy concern because the skill appears to impose a specific language by default rather than offering user choice or documenting a justified regional restriction.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The file’s natural-language interface, usage text, errors, and status messages are entirely in Chinese, and there is no indication that users can opt into another language or that the skill is intentionally restricted to a Chinese-only audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Intent-Code Divergence

Low

• Confidence: 95% confidence
• Finding: L077 的注释写明“不是 JSON 就当作纯文本材料（例如直接粘贴的合同全文）”，但该脚本其余文档与 manifest 都明确限定为低值易耗品台账/周转材料摊销核对。这里不是单纯信息不全，而是举了与技能意图明显不同的材料类型，主动传达了更宽泛的适用对象。

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The JSON value consists entirely of Chinese headers and entries, indicating a fixed language/locale output. There is no accompanying natural-language indication that this is optional, user-selected, or justified as a region-specific template, which can violate language/locale policy requirements.

Static analysis

No suspicious patterns detected.