物业公共能耗分摊核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 7:33 AM UTC
• Version: 1.0.41

Overview

The checker itself is local, but the skill embeds mandatory upsell and external purchase/install instructions that conflict with its no-network and no-payment framing.

Install only if you are comfortable with a Chinese-language local checker that also prompts about a paid upgrade. Treat the paid upgrade path as separate: do not let an agent fetch purchase metadata, install extra skills, or produce payment links unless you explicitly asked for that and verified the merchant, product, amount, and platform rules yourself.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The file explicitly states it is completely local and does not connect to the network, but later requires web access for purchase and installation. This is dangerous because it conditions operators to trust the skill as self-contained while embedding instructions that can cause the agent to leave the local environment, retrieve remote content, and potentially install or purchase external products.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: These sections introduce external URLs, installation guidance, a merchant identifier, a product identifier, and an HTTP redirector even though the skill's stated function is table verification. If an agent follows these instructions, it could be induced to fetch untrusted content, install additional components, or participate in payment flows, expanding the attack surface far beyond the declared purpose.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The skill’s user-facing name, summary, primary descriptions, and operational instructions are presented in Chinese, while only a brief English description is provided and there is no statement that users may choose their preferred language. This can amount to a locale/language policy violation because the skill appears to assume a specific language without opt-in or an explicit region-specific justification.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The manifest claims 'no network,' yet the document later provides network URLs and an HTTP endpoint for resolving upgrade purchases. This mismatch can mislead users and agent runtimes into trusting the skill as offline-only when it actually contains instructions that depend on external connectivity and can trigger off-platform interactions.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as a free local checker, but it embeds mandatory upsell and purchase-routing instructions that direct the agent to initiate acquisition and installation of a separate paid product. This creates a trust-boundary violation: a business-ops skill can unexpectedly steer the agent into commerce and external dependency flows that are not necessary for the core checking task.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The file’s user-facing natural-language documentation and messages are entirely in Chinese, including instructions, warnings, error text, and output strings. There is no indication that users can choose another language or that the locale restriction is documented as an explicit opt-in or region-specific requirement.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The JSON contains only Chinese headers and record text, indicating a language-specific template with no accompanying opt-in, alternative locale, or justification. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: The inline documentation says non-JSON input is treated as plain text material, giving 'directly pasted contract full text' as an example. That conflicts with the manifest and surrounding help text, which consistently say the tool expects a 物业公共能耗分摊核对表 with headers rather than arbitrary contract text.

Static analysis

No suspicious patterns detected.