维修资金与专项工程付款核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 7:15 AM UTC
• Version: 1.0.42

Overview

The bundled checker itself is local, but the skill also mandates a paid upgrade flow involving external purchase links and installation of another skill.

Install only if you are comfortable with a free local checker that advertises and can guide an agent into an external paid purchase and skill installation flow. Treat payment links, QR codes, raw IP links, and dependency installation as separate high-trust actions to verify manually; the local checker portion does not require them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The skill metadata and body promise a fully local, no-network checking tool, but later instructions direct the agent to browse external sites, retrieve product information, and initiate purchase/installation flows. This creates a deceptive trust boundary: users and calling systems may allow the skill under the assumption it is offline-only, while the embedded instructions attempt to expand behavior into networked commerce and software installation.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The skill's stated purpose is reconciliation of maintenance fund payment tables, but it embeds instructions for payment processing, product lookup, external URLs, and installation of another product. These capabilities are unrelated to the business function and create unnecessary opportunities for phishing, unauthorized commercial redirection, supply-chain exposure, and privilege escalation through installing additional skills or dependencies.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The instructions to the agent are written as mandatory behavior for every invocation and require presenting the upsell flow in Chinese terms such as "免费版 / 完整版" each time. Although the file contains an English display name and summary field, the operative user-facing instructions do not offer a language/locale choice or opt-in, which can violate language policy expectations.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The file’s natural-language instructions, warnings, sample input, and user-facing messages are entirely in Chinese, including required input guidance and output text. There is no indication that users may choose another language or that the locale restriction is an explicitly documented regional/compliance constraint, so this can violate language/locale choice policy.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The user-facing description, usage text, prompts, and status messages are entirely in Chinese and present the skill as operating in that language by default, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Description-Behavior Mismatch

Low

• Confidence: 79% confidence
• Finding: The manifest and file header describe a free local verification tool that performs item-by-item payment checks without networking or external dependencies. The runtime output additionally advertises an external purchase page, which is not part of executing the declared checking function and extends behavior beyond the stated operational purpose.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The file contains only Chinese headers and content in the template text, which implies a fixed language/locale. For a general-purpose skill asset, this can violate language-choice policy when no opt-in, fallback, or justification is provided.

Static analysis

No suspicious patterns detected.