ClawHub
Back to skill

Security audit

工资代发与银行回单核对（免费版）

Security checks for vulnerabilities and agentic risk

Overview

This is a local payroll reconciliation helper that is limited but clearly discloses its free-version scope and does not show hidden network, persistence, credential, or destructive behavior.

Install only if you are comfortable running a Chinese-language local payroll checker on payroll table data. The tool says it does not send data over the network, and inspection found no network or persistence behavior, but the free version intentionally omits several reconciliation checks, including bank receipt amount versus disbursement amount comparison, so do not rely on it as a complete financial control.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill markets itself as a payroll disbursement and bank receipt reconciliation tool, but the free version explicitly omits a core bank-receipt-to-payment amount comparison while still using broad wording that implies comprehensive checking. In a payroll/finance context, that can cause operators to rely on incomplete controls, miss payment discrepancies or duplicate/failed disbursement issues, and make incorrect accounting decisions based on a false sense of coverage.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
node scripts/run.mjs --sample # 先看样例

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
node scripts/run.mjs --sample # 先看样例

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Core user-facing fields such as displayName, summary, description, and trigger phrases are presented in Chinese, while the English metadata is only partial and does not provide equivalent trigger guidance. Under SQP-3, forcing a specific language or locale without opt-in is a policy concern unless a language choice or clear justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file’s user-facing natural language strings, comments, examples, and returned messages are entirely in Chinese, including required input guidance and output disclaimers. There is no indication that the skill offers a language choice or that the locale restriction is explicitly documented as a justified region-specific constraint, which can violate organizational language/locale policy requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The user-facing description, usage text, errors, and operational messaging are entirely in Chinese, and the file does not indicate that language selection is optional or configurable. Under the policy, a skill that forces a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The manifest says "触发词包括 工资代发与银行回单核对、工资代发与银行回单核对表对不上" but does not clarify whether these are the only triggers, nor when similar phrases should not invoke the skill. Because SQP-1 applies to markdown/manifest content, this lack of trigger-boundary specificity can cause unintended activation in adjacent accounting contexts.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

L075 的注释写明“不是 JSON 就当作纯文本材料（例如直接粘贴的合同全文）”，但该脚本整体能力、帮助文本和清单都围绕“工资代发与银行回单核对表”展开。这里的内联文档把输入示例写成了无关的合同全文，属于文档意图与实际技能用途相矛盾的表述。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The JSON value is entirely structured around Chinese column headers and status labels, which implies a fixed language/locale behavior. For a general-purpose skill artifact, this can violate language-choice policy when no opt-in or justification for the locale is provided.

Content

No source excerpt is available for this finding.