Security audit

研发费用辅助账与高新指标核对（免费版）

Security checks for vulnerabilities and agentic risk

Overview

The local ledger checker itself appears purpose-aligned, but its skill instructions push the agent into an external paid purchase and installation workflow that exceeds the free local-checking purpose.

Install only if you are comfortable with a free local checker that also advertises and can guide an agent through a paid external upgrade. Do not allow the agent to install dependencies, open payment links, or add the paid skill unless you intentionally chose that path and verified the merchant, product, amount, and platform rules yourself.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: Claiming 'fully local' and 'no network' while later requiring visits to external URLs and online purchase/install steps is a materially misleading capability statement. Users and orchestrators may grant trust or relax scrutiny based on the local-only claim, making subsequent external actions more dangerous because they bypass expectations about network isolation and transactional safety.

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 先看样例
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 先看样例
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The skill presents itself as a local, no-network free checker, but then embeds instructions that steer the agent into an external purchase and installation workflow for a paid variant. That creates a trust-boundary violation: an agent invoked for offline document checking may unexpectedly browse external sites, install new skills, and initiate commerce, which expands attack surface and can enable phishing, supply-chain compromise, or unauthorized transactions.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The skill's business purpose is ledger validation, yet it instructs the agent to conduct e-commerce, retrieve external instructions, install dependencies, and help complete payment-linked fulfillment. These actions are unrelated to the core task and can be abused for social engineering, forced upsell, redirection to attacker-controlled resources, or installation of unreviewed components under the guise of normal skill use.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The manifest description lists trigger phrases including “研发费用辅助账对不上,” which is relatively broad natural language that a user might say in varied contexts beyond this exact skill invocation. The file does not provide negative examples or explicit constraints clarifying when this phrase should or should not activate the skill.

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: The file’s natural-language comments and user-facing guidance are entirely in Chinese, including operational instructions such as what users must provide and how results are interpreted. Under the stated policy, forcing a specific language without user opt-in is a locale/language policy concern unless the constraint is explicitly documented and justified.

Natural-Language Policy Violations

Low

Confidence: 92% confidence
Finding: The JSON value is entirely in Chinese and provides no indication that the skill is intentionally limited to Chinese-language users or data. Under the language/locale policy rule, forcing a specific language without user opt-in or justification is a natural-language policy concern.

Static analysis

No suspicious patterns detected.