制造业月度自查包（免费版）

• Outcome: Review
• Latest audit: Sep 20, 2026 · 1:23 PM UTC
• Version: 1.0.49

Overview

This local accounting self-check skill does not show data theft or persistence, but it can falsely report no issues when required check sections are missing.

Review before installing. The code appears local-only, but do not rely on a clean result unless the JSON output shows every expected section as ok and sections_done matches the intended checks. Treat missing_section, insufficient_input, or sections_done below 3 as no valid conclusion, even if summary says NO_ISSUE_FOUND.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The discrepancy between the advertised three-check workflow and an implementation limited to one type of table/check creates a reliability and trust issue with operational consequences. Because the skill is intended for fixed monthly close and reconciliation workflows, users may treat missing analyses as having passed, which can mask errors rather than merely degrade convenience.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The discrepancy between the advertised three-check workflow and an implementation limited to one type of table/check creates a reliability and trust issue with operational consequences. Because the skill is intended for fixed monthly close and reconciliation workflows, users may treat missing analyses as having passed, which can mask errors rather than merely degrade convenience.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The discrepancy between the advertised three-check workflow and an implementation limited to one type of table/check creates a reliability and trust issue with operational consequences. Because the skill is intended for fixed monthly close and reconciliation workflows, users may treat missing analyses as having passed, which can mask errors rather than merely degrade convenience.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: Overly broad trigger phrases like generic month-end or 'what to do if it doesn't match' can cause accidental invocation in unrelated contexts. That can expose sensitive business materials to the wrong skill, waste operator time, or generate misleading outputs when users intended a different workflow.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The header comment presents an input example section named "银行流水对账", but the code only supports three manufacturing checks listed in BUNDLE_CHECKS and iterates exclusively over those names. This is not merely incomplete documentation: it actively suggests a different check type is accepted when the implementation will ignore it and mark the real required sections as missing.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This JavaScript file presents its documentation, warnings, and returned user-facing messages entirely in Chinese, and there is no indication that the skill is China-specific or that users can choose another language. That creates a natural-language locale policy issue because the skill imposes a specific language by default rather than offering opt-in or documenting a justified regional constraint.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This JavaScript file’s user-facing comments, messages, and disclaimers are entirely in Chinese, and the runtime guidance returned to users is also Chinese-only. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The disclaimer claims the tool verifies the arithmetic relation 'issued quantity × unit price = amount', but the implementation never performs that check. In an accounting/self-check skill, this can mislead users into trusting a control that does not exist, allowing amount manipulation or simple data-entry errors to pass undetected.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This JavaScript file embeds all user-facing natural-language documentation, guidance, and result text exclusively in Chinese, including operational instructions and disclaimers. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not stated here.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The user-facing description, help text, status messages, and outputs are entirely in Chinese, and the file does not offer any language selection or opt-in. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The JSON payload consists entirely of Chinese-language report content, indicating a fixed language/locale behavior. Under the policy rule, forcing a specific language without user opt-in or a documented justification is a natural-language policy concern.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: Line L13 actively describes the skill as 'A free deterministic check for 分段制造核对材料', which conflicts with the manifest’s main Chinese description that this skill performs three specific manufacturing monthly checks: production input/output and scrap rate, material requisition and quota loss, and inventory in/out with weighted average cost. This is more than an incomplete translation; it presents a different apparent scope and intent in documentation.

Intent-Code Divergence

Low

• Confidence: 96% confidence
• Finding: L075 的注释写道“不是 JSON 就当作纯文本材料（例如直接粘贴的合同全文）”，但该脚本其余文档和清单均表明它用于制造业月度自查、分段制造核对材料，而非合同审查。代码实际会把任意纯文本交给制造业自查引擎处理，因此该注释对技能意图给出了相互矛盾的示例。

Static analysis

No suspicious patterns detected.