工程与项目结算技能包（免费版）

• Outcome: Pass
• Latest audit: Sep 20, 2026 · 1:37 PM UTC
• Version: 1.0.26

Overview

This is a local Chinese-language project settlement checker that reads user-provided files and reports calculation issues without network access, file writes, or persistence.

Install only if you are comfortable running a local Chinese-language Node.js checker over project settlement materials. Treat its output as a calculation and consistency aid, not an audit or legal/valuation decision, and pay attention to checks marked not run or sub-checks not run before relying on results.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (41)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This finding is less about a specific missing domain and more about versioning and architectural ambiguity: the description suggests the package itself performs all 14 checks, while actual behavior may depend on separate parts engines and may refuse complete conclusions on insufficient material. That still creates integrity risk, though it is somewhat less direct than the more explicit overclaim findings.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This finding is less about a specific missing domain and more about versioning and architectural ambiguity: the description suggests the package itself performs all 14 checks, while actual behavior may depend on separate parts engines and may refuse complete conclusions on insufficient material. That still creates integrity risk, though it is somewhat less direct than the more explicit overclaim findings.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This finding is less about a specific missing domain and more about versioning and architectural ambiguity: the description suggests the package itself performs all 14 checks, while actual behavior may depend on separate parts engines and may refuse complete conclusions on insufficient material. That still creates integrity risk, though it is somewhat less direct than the more explicit overclaim findings.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: This finding is less about a specific missing domain and more about versioning and architectural ambiguity: the description suggests the package itself performs all 14 checks, while actual behavior may depend on separate parts engines and may refuse complete conclusions on insufficient material. That still creates integrity risk, though it is somewhat less direct than the more explicit overclaim findings.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This finding is less about a specific missing domain and more about versioning and architectural ambiguity: the description suggests the package itself performs all 14 checks, while actual behavior may depend on separate parts engines and may refuse complete conclusions on insufficient material. That still creates integrity risk, though it is somewhat less direct than the more explicit overclaim findings.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This finding is less about a specific missing domain and more about versioning and architectural ambiguity: the description suggests the package itself performs all 14 checks, while actual behavior may depend on separate parts engines and may refuse complete conclusions on insufficient material. That still creates integrity risk, though it is somewhat less direct than the more explicit overclaim findings.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This finding is less about a specific missing domain and more about versioning and architectural ambiguity: the description suggests the package itself performs all 14 checks, while actual behavior may depend on separate parts engines and may refuse complete conclusions on insufficient material. That still creates integrity risk, though it is somewhat less direct than the more explicit overclaim findings.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This finding is less about a specific missing domain and more about versioning and architectural ambiguity: the description suggests the package itself performs all 14 checks, while actual behavior may depend on separate parts engines and may refuse complete conclusions on insufficient material. That still creates integrity risk, though it is somewhat less direct than the more explicit overclaim findings.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This finding is less about a specific missing domain and more about versioning and architectural ambiguity: the description suggests the package itself performs all 14 checks, while actual behavior may depend on separate parts engines and may refuse complete conclusions on insufficient material. That still creates integrity risk, though it is somewhat less direct than the more explicit overclaim findings.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This finding is less about a specific missing domain and more about versioning and architectural ambiguity: the description suggests the package itself performs all 14 checks, while actual behavior may depend on separate parts engines and may refuse complete conclusions on insufficient material. That still creates integrity risk, though it is somewhat less direct than the more explicit overclaim findings.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This finding is less about a specific missing domain and more about versioning and architectural ambiguity: the description suggests the package itself performs all 14 checks, while actual behavior may depend on separate parts engines and may refuse complete conclusions on insufficient material. That still creates integrity risk, though it is somewhat less direct than the more explicit overclaim findings.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This finding is less about a specific missing domain and more about versioning and architectural ambiguity: the description suggests the package itself performs all 14 checks, while actual behavior may depend on separate parts engines and may refuse complete conclusions on insufficient material. That still creates integrity risk, though it is somewhat less direct than the more explicit overclaim findings.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This finding is less about a specific missing domain and more about versioning and architectural ambiguity: the description suggests the package itself performs all 14 checks, while actual behavior may depend on separate parts engines and may refuse complete conclusions on insufficient material. That still creates integrity risk, though it is somewhat less direct than the more explicit overclaim findings.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This finding is less about a specific missing domain and more about versioning and architectural ambiguity: the description suggests the package itself performs all 14 checks, while actual behavior may depend on separate parts engines and may refuse complete conclusions on insufficient material. That still creates integrity risk, though it is somewhat less direct than the more explicit overclaim findings.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This finding is less about a specific missing domain and more about versioning and architectural ambiguity: the description suggests the package itself performs all 14 checks, while actual behavior may depend on separate parts engines and may refuse complete conclusions on insufficient material. That still creates integrity risk, though it is somewhat less direct than the more explicit overclaim findings.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单项目样例（内置）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单项目样例（内置）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单项目样例（内置）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单项目样例（内置）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file explicitly states it is a free subset and omits several checks, while the skill metadata promises a comprehensive 14-check per-project review. This creates a dangerous integrity gap: users may rely on the skill for settlement assurance and miss overpayment, over-contract, or other material financial issues that the manifest says are covered but this engine never executes.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The file’s comments, user-facing advice, messages, labels, notes, and disclaimer are all written in Chinese, and the code returns Chinese-only strings to the user. There is no indication that the skill is region-specific or that users can opt into another language, which makes this a natural-language locale policy issue under the stated rules.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The file claims the free tier withholds paid checks, but it still exposes paid-tier behavior metadata and thresholds through constants, result fields, and module exports. That leaks internal product logic and guardrails to users, which can help reverse-engineer premium functionality or undermine packaging controls even without any network activity.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The file states it is only a free subset and withholds additional checks, while the surrounding skill metadata advertises a broader 14-item project-by-project review capability. This mismatch can mislead users into believing a comprehensive control set was applied when only a narrow subset ran, creating a coverage gap that may hide material issues.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file’s natural-language comments, user-facing advice, messages, disclaimers, and sample text are entirely in Chinese, and there is no indication that users may choose another language or locale. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The disclaimer claims the tool checks date ordering such as start/conversion/depreciation sequence, but the implementation explicitly withholds those checks and never executes them. This can cause users to rely on a control that does not exist, leading to missed accounting errors and incorrect settlement conclusions in a financial review workflow.

Static analysis

No suspicious patterns detected.