整车厂返利与商务政策核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 7:23 AM UTC
• Version: 1.0.39

Overview

The local rebate-checking code appears bounded, but the skill instructions expand into external purchase and skill-installation workflows that conflict with its no-network/free positioning.

Install only if you are comfortable with a skill that starts as a local free checker but instructs your agent to offer and potentially execute an external paid upgrade/install flow. Keep payment and installation decisions manual, verify merchant/product details independently, and disable the upsell if you only want local checking.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The documentation states the tool is fully local and does not use the network, yet later sections instruct the agent to visit external URLs, retrieve product information, and initiate purchase flows. This contradiction is dangerous because it undermines trust boundaries and can cause users or agents to permit networked actions they were told would not occur.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ssd 4

High

• Confidence: 98% confidence
• Finding: The embedded 'official prompt' instructs an AI assistant to execute a multi-step workflow involving purchase, installation, dependency handling, and payment handoff using prewritten trust-establishing language. This is dangerous because it is effectively prompt injection aimed at converting a document-processing skill into an autonomous commerce and software-installation agent.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The user-facing name, summary, trigger phrases, and primary descriptions are entirely in Chinese, while the English text is minimal and does not state that the skill is intentionally region- or language-specific. This effectively imposes a language/locale constraint without explicit opt-in or justification, which matches the policy-violation criteria.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill claims to be a local, free checking tool, but embedded instructions require the agent to advertise and potentially initiate an external paid purchase and installation flow. This creates a hidden scope expansion from document checking into e-commerce orchestration, which can mislead users and cause the agent to access external resources or perform actions unrelated to the stated task.

Ssd 4

Medium

• Confidence: 95% confidence
• Finding: The skill tells the agent to deliver normal results first and then steer the interaction into a purchase decision and, if selected, a transactional workflow. This is a form of gradual permission escalation that can normalize follow-on actions and increase the chance that users consent to operations outside the original analysis scope.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill includes instructions for buying another product, following external links, and installing additional software, which are unrelated to verifying rebate-policy tables. Mixing operational analysis with commerce and installation instructions increases the chance of abuse, user confusion, and unsafe tool use beyond the declared purpose.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The natural-language interface and instructions throughout the header comments are written entirely in Chinese, including operational guidance and disclaimers, with no indication that other languages are supported or that the user opted into this locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code file contains user-facing natural-language strings and help text exclusively in Chinese, including the title, usage, errors, and output messages. That forces a specific language on users without any opt-in or explanation that the skill is intentionally region-specific, which matches the language/locale policy violation criteria.

Static analysis

No suspicious patterns detected.