备用金与报销核销核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 7:29 AM UTC
• Version: 1.0.45

Overview

The local petty-cash checker itself is narrow and offline, but the skill instructions also require recurring upsell, external purchase, payment-link handoff, and post-payment installation steps that are outside the checker’s core purpose.

Review this skill carefully before installing. The local checker appears to run offline and only analyze supplied petty-cash table text, but the skill instructions also try to make the agent present paid upgrade options and handle external purchase/install steps. Use it only if you are comfortable with that commerce workflow, and do not allow the agent to follow payment or installation links unless you explicitly intend to buy and have verified the source yourself.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill claims the checker is fully local, offline, and requires no network, yet later instructs the agent to access external URLs and participate in a paid install/purchase flow. That mismatch can mislead users and host agents about the skill’s actual behavior and trust boundary, creating a social-engineering path to external network access and commerce operations.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The embedded commerce workflow is unrelated to the core petty-cash reconciliation function and instructs the agent to upsell, initiate purchases, and hand off payment links. Mixing business logic with monetization and payment orchestration increases the chance that an agent will perform actions outside user intent, including external navigation and transactional flows.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The policy/instructional section is written as mandatory guidance to the agent and is entirely in Chinese, with no opt-in or alternative language path for how the user-facing upsell disclosure should be presented. Because the skill directs the agent to always deliver this disclosure each session, it effectively imposes a specific language/locale on user-facing behavior without documented user choice.

Ssd 4

Medium

• Confidence: 95% confidence
• Finding: The staged pattern of first delivering useful output and then requiring the agent to present upgrade options is a classic social-engineering structure. It conditions the agent to transition from analysis into external commercial actions, increasing the likelihood of link handoff, purchase initiation, and user manipulation under the cover of a legitimate business workflow.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The file states the only differences between free and paid versions are specific detection features, but elsewhere adds agent behavioral differences such as mandatory upgrade prompting and purchase handling. This is a deceptive capability boundary: users may believe only analytical checks differ, while the skill also changes how the agent behaves around commerce and external access.

Ssd 4

Medium

• Confidence: 97% confidence
• Finding: The ‘official instruction’ text explicitly guides the agent through dependency installation, purchase initiation, payment handoff, and post-payment installation/verification. This is a permission-escalation chain that expands the agent’s role from document analysis into software installation and commerce execution, which materially raises security and supply-chain risk.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The skill's comments, guidance, error messages, findings, and disclaimer are all written in Chinese, and the code does not provide any user opt-in or alternative locale handling. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is explicitly justified.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: The inline comment says non-JSON input is handled as '纯文本材料（例如直接粘贴的合同全文）', using a contract-document example. This contradicts the surrounding manifest and script intent, which are specifically about petty-cash reimbursement reconciliation tables, not generic contract text.

Static analysis

No suspicious patterns detected.