材料成本差异分摊核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 7:17 AM UTC
• Version: 1.0.44

Overview

The local checker appears purpose-built, but the skill also pushes an external payment and follow-on installation flow despite prominent no-payment/no-network claims.

Install only if you are comfortable with the skill showing an upsell and potentially directing an agent through external payment and installation steps. For the free checker, use the local script path only and avoid following the paid SkillPay, raw IP, or onboarding installation instructions unless you independently trust and verify those providers.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill claims it is fully local and uses no network, but elsewhere instructs the agent to access external URLs and payment flows. This is a trust-boundary violation: users and host systems may grant the skill broader trust or reduced scrutiny based on false locality claims, while the embedded upsell flow introduces network-dependent behavior and external interaction.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The inline documentation repeats that the skill does not use the network, yet later requires access to web pages and purchase endpoints. Repeated contradictory assurances can socially engineer operators and users into trusting the skill more than warranted, making subsequent external-link behavior more likely to succeed without scrutiny.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill embeds a purchase, payment, and installation workflow that is unrelated to its stated purpose of checking material cost variance tables. This is dangerous because it attempts to steer the agent into handling commerce, external links, and follow-on installation steps, expanding scope from data checking to monetization and supply-chain interaction that could expose users to phishing, unauthorized purchases, or installation of unreviewed components.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The instructions in the '版本选择协议' section mandate exact user disclosures and interaction flow, but they are written only in Chinese and do not offer any language or locale opt-in. This creates a natural-language policy issue because the skill effectively constrains user-facing communication to a specific language without documenting a choice or justified locale restriction.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The prominent natural-language guidance at the top of the file is written in Chinese and the skill’s user-facing strings throughout the file are also Chinese-only. This constitutes a language policy concern because the skill does not offer an explicit language or locale choice, nor does it document a justified region-specific restriction.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: This JSON template embeds all visible natural-language content in Chinese, with no indication that language selection is optional or region-specific. That can violate a language/locale policy when a skill forces a specific language without user opt-in.

Static analysis

No suspicious patterns detected.