采购与付款技能包（免费版）

• Outcome: Pass
• Latest audit: Sep 20, 2026 · 1:34 PM UTC
• Version: 1.0.24

Overview

This is a local procurement and payables checking skill that reads user-provided business files and reports findings without network use, file writes, persistence, or hidden privilege behavior.

Install only if you are comfortable running a local checker over procurement, payables, contract, invoice, and reimbursement text you provide. Review the output fields listing checks not run and sub-checks not run, and do not treat a clean result as an audit opinion or proof that payments, contracts, invoices, or accounting treatment are valid.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (50)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documentation itself acknowledges free-vs-full differences and withheld checks, yet still presents the skill as a complete 14-check pack, which can confuse users about what was actually executed. Because this is a local business-control tool, the primary risk is deceptive completeness leading to missed exceptions rather than external attack.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documentation itself acknowledges free-vs-full differences and withheld checks, yet still presents the skill as a complete 14-check pack, which can confuse users about what was actually executed. Because this is a local business-control tool, the primary risk is deceptive completeness leading to missed exceptions rather than external attack.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The documentation itself acknowledges free-vs-full differences and withheld checks, yet still presents the skill as a complete 14-check pack, which can confuse users about what was actually executed. Because this is a local business-control tool, the primary risk is deceptive completeness leading to missed exceptions rather than external attack.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documentation itself acknowledges free-vs-full differences and withheld checks, yet still presents the skill as a complete 14-check pack, which can confuse users about what was actually executed. Because this is a local business-control tool, the primary risk is deceptive completeness leading to missed exceptions rather than external attack.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The documentation itself acknowledges free-vs-full differences and withheld checks, yet still presents the skill as a complete 14-check pack, which can confuse users about what was actually executed. Because this is a local business-control tool, the primary risk is deceptive completeness leading to missed exceptions rather than external attack.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The documentation itself acknowledges free-vs-full differences and withheld checks, yet still presents the skill as a complete 14-check pack, which can confuse users about what was actually executed. Because this is a local business-control tool, the primary risk is deceptive completeness leading to missed exceptions rather than external attack.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The documentation itself acknowledges free-vs-full differences and withheld checks, yet still presents the skill as a complete 14-check pack, which can confuse users about what was actually executed. Because this is a local business-control tool, the primary risk is deceptive completeness leading to missed exceptions rather than external attack.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documentation itself acknowledges free-vs-full differences and withheld checks, yet still presents the skill as a complete 14-check pack, which can confuse users about what was actually executed. Because this is a local business-control tool, the primary risk is deceptive completeness leading to missed exceptions rather than external attack.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documentation itself acknowledges free-vs-full differences and withheld checks, yet still presents the skill as a complete 14-check pack, which can confuse users about what was actually executed. Because this is a local business-control tool, the primary risk is deceptive completeness leading to missed exceptions rather than external attack.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documentation itself acknowledges free-vs-full differences and withheld checks, yet still presents the skill as a complete 14-check pack, which can confuse users about what was actually executed. Because this is a local business-control tool, the primary risk is deceptive completeness leading to missed exceptions rather than external attack.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documentation itself acknowledges free-vs-full differences and withheld checks, yet still presents the skill as a complete 14-check pack, which can confuse users about what was actually executed. Because this is a local business-control tool, the primary risk is deceptive completeness leading to missed exceptions rather than external attack.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The documentation itself acknowledges free-vs-full differences and withheld checks, yet still presents the skill as a complete 14-check pack, which can confuse users about what was actually executed. Because this is a local business-control tool, the primary risk is deceptive completeness leading to missed exceptions rather than external attack.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documentation itself acknowledges free-vs-full differences and withheld checks, yet still presents the skill as a complete 14-check pack, which can confuse users about what was actually executed. Because this is a local business-control tool, the primary risk is deceptive completeness leading to missed exceptions rather than external attack.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documentation itself acknowledges free-vs-full differences and withheld checks, yet still presents the skill as a complete 14-check pack, which can confuse users about what was actually executed. Because this is a local business-control tool, the primary risk is deceptive completeness leading to missed exceptions rather than external attack.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documentation itself acknowledges free-vs-full differences and withheld checks, yet still presents the skill as a complete 14-check pack, which can confuse users about what was actually executed. Because this is a local business-control tool, the primary risk is deceptive completeness leading to missed exceptions rather than external attack.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单对象样例（内置）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单对象样例（内置）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单对象样例（内置）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单对象样例（内置）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file explicitly states it is only a free-tier subset that runs 6 checks and withholds 5 additional checks, while the skill metadata promises broad 14-item procurement/payables coverage. In an audit or finance workflow, this mismatch can cause users to rely on incomplete control results, creating a false sense of assurance and potentially missing material accounting issues.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The code and comments explicitly state that several payable-provisional checks advertised in the broader skill description are withheld and never executed, yet the engine still returns them as part of the surfaced capability metadata. In an audit or finance workflow, this creates a dangerous false sense of coverage: users may rely on the tool to detect overdue reversals, unmatched invoices, or stale accruals when those checks are in fact absent.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file header explicitly narrows behavior to a local 'free tier' six-check contract consistency engine, while the skill metadata promises a broader 14-item procurement/payables audit workflow. This mismatch is dangerous because users may rely on the advertised coverage for financial control review and falsely believe required checks were performed when they were silently omitted.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The run() path returns a service type of 'CONTRACT_CONSISTENCY_FREE', lists only six checks, and marks other checks as withheld, which directly contradicts the skill's advertised end-to-end procurement/payables review scope. In an audit context, this can cause under-auditing, missed exceptions, and incorrect compliance or accounting conclusions because the output looks authoritative despite limited coverage.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest describes a broad skill that locally audits procurement and payable working papers across 14 named checks, with per-object conclusions and source line references. This file implements only an expense reimbursement precheck subset: duplicate invoice number detection, invoice field completeness, and placeholder detection, while explicitly listing many expected reimbursement checks as withheld and not implemented.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The natural-language guidance and user-facing strings throughout the file are exclusively in Chinese, including operational instructions and disclaimers. There is no indication that the skill is region-specific or that users may opt into another language, which can violate language/locale policy requirements.

Static analysis

No suspicious patterns detected.