商场联营抽成与保底核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 7:22 AM UTC
• Version: 1.0.40

Overview

The core checker appears local, but the skill also includes under-disclosed instructions to upsell users into an external purchase and skill installation flow.

Use this only if you want a Chinese local reconciliation checker and are comfortable ignoring or disabling the upsell. Do not let an agent initiate the paid SkillPay purchase or install additional skills unless you deliberately asked for that, verify the merchant/product details yourself, and keep payment confirmation under your direct control.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The documentation explicitly claims the tool is 'completely local' and 'no network,' yet later sections instruct use of remote URLs and purchase endpoints. This contradiction is dangerous because users and agents may grant trust based on the local-only claim while the skill actually attempts to drive network access and external interactions.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill markets itself as a free, local, no-network checker, but embedded instructions require the agent to present upsell options and potentially initiate a remote purchase/install flow. This creates a trust-boundary violation: a user invoking a local document-checking tool could be steered into external transactions and installation steps unrelated to the core audit task.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The file includes payment facilitation, external purchase URLs, merchant identifiers, and instructions for buying/installing another product, none of which are necessary for a mall concession reconciliation checker. If followed by an agent, these instructions could enable phishing, unauthorized transaction initiation, or unreviewed installation of external components under the guise of normal skill operation.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The operational instructions to the agent are written as mandatory behavior and require presenting the upsell flow in Chinese-language terms such as "免费版 / 完整版" every time the skill is used. Although the file includes an English description field, it does not offer the user a language or locale choice for these required user-facing disclosures, which creates a language-policy concern.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code file contains extensive natural-language instructions, warnings, and output text exclusively in Chinese, including the top-level comments and later user-facing messages. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not stated here.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This manifest-style JSON contains only Chinese headers and values in the primary text payload, indicating a fixed language/locale assumption. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy concern.

Description-Behavior Mismatch

Low

• Confidence: 89% confidence
• Finding: The manifest and file header describe a free, local-only verification tool for mall concession/guarantee checks. Printing a public purchase/upgrade URL is additional promotional behavior not described as part of the skill's checking function, so the actual behavior slightly exceeds the claimed scope.

Static analysis

No suspicious patterns detected.