工程材料调拨与领用核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 7:30 AM UTC
• Version: 1.0.42

Overview

The checker code is local, but the skill also pushes users into external payment and skill-installation flows that are not clearly aligned with its free offline framing.

Review this before installing because the local checker appears harmless, but the skill instructions also promote a paid upgrade and can lead an agent toward external payment links and installing other skills. Use it only if you are comfortable ignoring or disabling the upsell, and do not authorize purchases, wallet actions, dependency installation, or new skill installation unless you independently trust the marketplace flow and merchant details.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The documentation explicitly claims 'fully local' and 'no network', but later sections require visiting external websites and payment endpoints. This inconsistency is a security issue because operators, policy engines, or users may trust the skill under a false offline-only model and miss that it contains instructions intended to trigger networked commercial actions.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is presented as a local, offline checking tool, but these sections instruct the agent to disclose upsell choices and, if selected, orchestrate a purchase flow using external payment and installation resources. That creates a deceptive trust boundary: a user or host agent may permit the skill under 'no network/no payment' assumptions, while the embedded instructions try to expand behavior into commerce and external navigation.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: These lines embed payment, external URL, and installation orchestration that is not necessary for validating engineering material transfer records. This is dangerous because it turns a business-checking skill into a vehicle for redirecting an agent or user into software installation and financial transaction steps, increasing the risk of phishing, unauthorized purchases, and policy bypass.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The instructions to the agent are written as mandatory behavior for every invocation and require presenting a specific upsell flow, but the surrounding user-facing text and required wording are only defined in Chinese. There is no indication that the agent should match the user's language or offer a locale choice, which can violate language/locale policy when used with non-Chinese-speaking users.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file-level comments and all user-facing instructional/disclosure text are written exclusively in Chinese, including warnings and usage guidance. This creates a locale constraint in natural-language interaction without documenting that the skill is Chinese-only or offering a language choice.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The user-facing description, help text, errors, and usage instructions are entirely in Chinese, and the file does not offer any language/locale selection or indicate that the skill is restricted to a specific region for compliance reasons. This is a natural-language policy concern because it imposes a specific language on users without opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The JSON text payload is entirely in Chinese and provides no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking or region-specific context. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Intent-Code Divergence

Low

• Confidence: 96% confidence
• Finding: L077 的注释写明“不是 JSON 就当作纯文本材料（例如直接粘贴的合同全文）”，但该脚本整体声明仅用于“工程材料调拨与领用核对表”核对。这里的文档示例主动暗示可处理合同全文，和技能意图范围相矛盾，属于注释层面的意图-代码偏差。

Static analysis

No suspicious patterns detected.