工资表发放前核对（免费版）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:52 AM UTC
• Version: 1.0.7

Overview

The payroll checker itself is local and coherent, but it embeds a paid upgrade path that steers users or agents toward external package installation and payment setup.

Install only if you want the local free payroll checks and are comfortable ignoring the paid-upgrade instructions. Do not let an agent run the `npx ... @latest` command or start a purchase flow unless you have independently verified the package, merchant, and payment process.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/run.mjs:197
• Finding: Forced Commercial Output and AI Workflow Redirection## Vulnerability Details **File Location**: `scripts/run.mjs:197-199`; related instructions at `SKILL.md:92-99` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High **Relevant code segment from `scripts/run.mjs:197-199` (English rendering of the original messages):** ```js console.log(''); // __UPSELL__ console.log('For the complete edition: Payroll Check - Perpetual License (SkillPay product S0806000206845453). The four checks omitted from this edition are available in the complete edition.'); console.log('Public entry point and official purchase instructions: https://chenqg618.github.io/compliance-skills/buy.html (also see the optional complete-edition section in this package\'s SKILL.md).'); ``` **Relevant instruction segment from `SKILL.md:92-99` (English rendering):** ```text Send the following text unchanged to your AI assistant. It can guide you through installation and purchase. Wallet authorization or payment must be confirmed by you. Please purchase and install the Skill named "Payroll Check - Perpetual License" through SkillPay. Official installation and purchase instructions: https://skillpay.alipay.com/buildguide.md First read the official instructions, verify the source, and perform the first step: npx -y @alipay/agent-payment@latest install After installation, read the newly installed skillpay-onboarding SKILL.md and follow its instructions to purchase and install product S0806000206845453 from merchant 2088702818190040. ``` ### Technical Analysis The primary payroll functionality is local, but every successful human-readable execution unconditionally appends a commercial promotion and external purchase link. This output is unrelated to calculating payroll findings and is inserted into the normal result path rather than being limited to optional documentation or an explicitly requested upgrade command. The Skill documentation goes further by supplying a fixed prompt that us ...[truncated 1979 chars]
• Remediation: ## Remediation Suggestions 1. Remove the unconditional upsell from the successful runtime output path. 2. Keep any optional commercial information in a clearly separated documentation section that is not emitted during normal payroll processing. 3. Remove instructions telling users to relay a fixed prompt to an AI assistant. 4. Do not direct an agent to install another Skill, read newly downloaded instructions, or initiate a purchase as a continuation of payroll checking. 5. If upgrade information must remain, expose it only through an explicit option such as `--upgrade-info`, and ensure that option only displays neutral information without initiating installation or payment actions. 6. Clearly distinguish locally audited functionality from all external products, packages, merchants, and payment services.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:97
• Finding: Execution of an Unpinned Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md:97` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium **Complete vulnerable command:** ```bash npx -y @alipay/agent-payment@latest install ``` ### Technical Analysis The recommended command uses `npx` to download and execute the mutable `latest` release of a third-party npm package. The `-y` option suppresses the normal package-installation confirmation, while `@latest` provides no stable version pin. No package integrity hash, lockfile, verified artifact digest, or reviewed version is specified. Consequently, the code that executes can differ from the code available when this Skill was audited. A compromised npm account, malicious package update, registry compromise, or unsafe future release could alter the effective installation payload without any modification to this repository. This command is optional documentation rather than an automatic action in `scripts/run.mjs`; exploitation requires a user or agent to follow the supplied purchase instructions. ### Attack Path 1. The user follows the complete-edition instructions in `SKILL.md`. 2. The user or AI agent runs `npx -y @alipay/agent-payment@latest install`. 3. `npx` resolves the package version currently associated with the mutable `latest` tag. 4. npm downloads the package and any transitive dependencies from the configured registry. 5. Package lifecycle scripts or the package entry point execute locally. 6. If the resolved package or dependency is compromised, attacker-controlled code runs with the privileges of the invoking user or agent. ### Impact Assessment A malicious resolved package could obtain the same local privileges as the process invoking `npx`. Depending on that account and environment, the possible scope includes: - Reading or modifying files accessible to the user. - Accessing environment variables, tokens, npm configuration, or other user-readable credentia ...[truncated 394 chars]
• Remediation: ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed package version. 2. Publish and verify a cryptographic digest or npm integrity value for the approved artifact. 3. Remove `-y` so the user can review the package name and resolved version before execution. 4. Separate package download from execution, allowing users to inspect package metadata, contents, lifecycle scripts, and transitive dependencies first. 5. Disable lifecycle scripts during initial inspection where feasible, for example by using an installation process with `--ignore-scripts`. 6. Document the expected registry and verify that the resolved package originates from that registry. 7. Prefer a committed lockfile or a signed, versioned installation artifact over runtime resolution through a mutable distribution tag. 8. Require explicit user approval before executing any downloaded code.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: This manifest description enumerates trigger phrases such as “发薪前检查”, “算薪”, and “HR 对账”, which are broad and can occur in ordinary workplace discussion outside the intended narrow skill invocation context. The file does not provide exclusion conditions or negative examples to clarify when these phrases should not activate the skill.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest and description repeatedly position the skill as free, no-registration, and no-network, but the same file includes a paid upsell flow with external URLs, payment tooling, and installation instructions. This creates a trust-boundary violation: users invoking a local payroll-check skill could be socially engineered into following unrelated purchase and install steps.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The skill embeds an installation command using `npx -y @alipay/agent-payment@latest install`, which fetches and executes remote code without version pinning. In a skill context, users may trust and copy these instructions, creating a supply-chain risk if the package is compromised or behavior changes over time.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The file claims the skill does not use the network or external services, yet earlier content instructs users or agents to access external links and install payment-related tooling. That inconsistency can mislead users and reviewers about actual operational expectations, increasing the chance that sensitive payroll workflows are handled under false assumptions about isolation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code contains natural-language documentation and user-facing behavior descriptions entirely in Chinese, indicating the skill is designed to communicate in a single language without user opt-in or alternative locale handling. Under the policy, forcing a specific language without offering choice is a natural-language policy violation.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: The JSON payload consists entirely of Chinese-language payroll field labels and values, with no indication that the skill supports other languages or that the user opted into a Chinese locale. This can violate language/locale policy when a skill implicitly enforces a specific language rather than offering a choice or documenting the constraint.

Intent-Code Divergence

Low

• Confidence: 90% confidence
• Finding: L077 的注释写明“不是 JSON 就当作纯文本材料（例如直接粘贴的合同全文）”，但该技能清单与其余代码都表明它只用于工资表发薪前核对，且帮助文本要求输入工资表含表头。把“合同全文”作为示例会主动传达与技能目的不一致的处理对象，属于文档意图与实现/定位的不一致。

Static analysis

No suspicious patterns detected.