委外加工费与损耗核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 7:22 AM UTC
• Version: 1.0.44

Overview

The checker code appears local and purpose-aligned, but the skill instructions expand into external purchase, payment-link, and paid-skill installation flows despite advertising no network and no payment.

Install only if you want a Chinese-language local checker and are comfortable ignoring its paid-upgrade prompts. Do not let an agent fetch purchase instructions, present payment QR codes, or install the paid version unless you intentionally requested that and independently verify the merchant, amount, product, and platform rules.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The documentation explicitly claims 'fully local' and 'no network', yet later directs use of several external URLs and purchase endpoints. This contradiction undermines trust boundaries and can cause agents or users to approve network actions they would otherwise reject, making deceptive or unsafe behavior more likely.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill presents itself as a local, no-network checking tool, but embedded instructions require the agent to initiate external purchase and installation flows, fetch official instructions, and provide payment links or QR codes. This creates a hidden scope expansion from offline document checking into commerce orchestration, increasing phishing, unauthorized monetization, and user-confusion risk.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The payment and product-purchase instructions are unrelated to the stated business purpose of verifying outsourced-processing settlement sheets. Embedding monetization workflow inside an accounting validation skill creates an opportunity for social engineering and can pressure the agent to perform risky actions outside the user’s original intent.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The markdown explicitly lists trigger phrases, so SQP-1 applies here. While "委外加工费与损耗核对" is fairly specific, the phrase "委外加工结算核对表对不上" is a broad natural-language complaint and the file does not provide exclusion conditions or negative examples clarifying when the skill should not activate.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The instructions mandate exact user-facing behavior in Chinese for every invocation, but the document does not offer users a language/locale option. Because SQP-3 applies to all file types, this is a natural-language policy concern: the skill appears to force a specific language without opt-in, even though the metadata includes English fields.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This JavaScript file contains all user-facing descriptions, warnings, error messages, and outputs in Chinese, including the introductory comments and runtime messages. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The user-facing description, usage text, prompts, and output strings are entirely in Chinese, and the skill does not indicate any user option to select another language. Under the policy criteria, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Intent-Code Divergence

Low

• Confidence: 95% confidence
• Finding: L400-L402 的免责声明声称结果包含“明显偏高”的档位提示，但实际执行的检查仅有 L343-L350 所列的复算、合计、重复、空白和负值检测，没有任何基于 LOSS_RATE_REF 或损耗率的提示检查。该文档表述会让调用方误以为当前版本已执行损耗率异常提示，与代码实际行为相矛盾。

Intent-Code Divergence

Low

• Confidence: 90% confidence
• Finding: The docstring says non-JSON input is treated as plain text material such as a directly pasted '合同全文', which suggests broader document handling. However, the surrounding help text and insufficient-input messaging consistently require a '委外加工结算核对表（含表头）', so the inline documentation overstates the accepted material type relative to the intended behavior.

Static analysis

No suspicious patterns detected.