研发支出资本化与费用化划分核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 9:31 AM UTC
• Version: 1.0.4

Overview

The local checker is mostly purpose-aligned, but the skill mixes an offline audit tool with mandatory upsell instructions that can drive external purchase and installation flows despite promising no network or payment.

Install only if you are comfortable with an R&D table checker that also contains paid-upgrade instructions. Treat the free runtime as local, but do not let an agent follow the purchase or installation steps unless you explicitly want that, have verified the merchant/product/order details, and are willing to install additional components.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: 整体上，这段代码的核心对象仍是“研发支出资本化/费用化相关明细表”，并且确实执行了合计勾稽、逐行算术复核、重复检测、空白/缺列检测等，和声明有较强相关性。但仍应判定为不匹配，原因有三点：第一，声明中的重要承诺“每条结论引用原文”在代码中没有实现，返回的只是计算证据字段，不是原文引用。第二，代码文件注释、说明及空输入报错明显混入了“股份支付费用分摊核对”的内容，这与声明的研发支出核对主题不一致，说明实现说明与实际用途存在混杂。第三，声明与触发词让人预期会检查“研发支出资本化与费用化划分核对/对不上”这类分类正确性问题，但代码明确把研究阶段有资本化、开发阶段资本化为0、资本化是否应发生等更实质的划分判断列为未执行项目；实际只做表内算术一致性核对。因此描述对能力边界有一定夸大，存在实质性描述-行为不一致。

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill presents itself as fully local and offline, yet later instructs the agent to access remote purchase and installation endpoints and retrieve external metadata. This deceptive scope expansion can cause an agent or user to trust the skill with fewer precautions, then be funneled into network activity, software installation, and commerce flows that materially increase supply-chain and phishing risk.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: Claiming 'completely local' and 'no network' while also including instructions that require external network access undermines user trust and can bypass risk-based decision making by downstream agents. The danger is amplified because users may approve the skill assuming it cannot initiate outbound connections, when in fact it contains documented network-dependent workflows.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Embedding commerce and software-installation instructions inside a skill whose stated purpose is auditing an R&D expense table creates an unjustified path to external actions unrelated to the user’s requested task. In an agent setting, this increases the chance of social engineering, unwanted package installation, or redirection to third-party payment flows under the guise of normal task execution.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file’s public-facing description and prompts describe a share-based-payment checker, while the implemented logic processes R&D capitalization fields. This mismatch can cause users to supply the wrong financial data and rely on conclusions for the wrong control objective, leading to materially incorrect compliance or accounting review outcomes.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The inline documentation claims one accounting control domain while the parser, labels, and validation rules enforce another. In an agent setting, documentation is part of the operational interface; contradictory guidance increases the chance of misrouting sensitive financial review tasks and producing false assurance.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The manifest description says the trigger phrases include “研发支出明细表对不上,” which is a natural-language complaint rather than a narrowly scoped command. Without negative examples or stricter activation constraints, this could cause unintended invocation whenever a user casually says their R&D detail table does not match.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Mandating that the agent advertise upgrade paths on every invocation and potentially complete a paid acquisition introduces persistent commercial behavior unrelated to the requested free audit. In agent environments, compulsory upsell logic can override user intent, normalize off-task external actions, and pressure the system into handling payment-adjacent flows that should remain separate and explicitly consented.

Natural-Language Policy Violations

Medium

• Confidence: 80% confidence
• Finding: The version-selection protocol requires the agent to present fixed user-facing wording on every invocation, but the skill does not offer any language choice despite containing both Chinese and English metadata. This creates a natural-language policy concern because the interaction is effectively forced into a specific locale without explicit user opt-in or a documented region-specific requirement.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file’s natural-language instructions, warnings, sample input, and returned advice/messages are all written exclusively in Chinese, with no indication that users may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: When input is missing, the tool instructs users to paste a share-based-payment allocation table even though the engine expects R&D capitalization data. This increases the likelihood of collecting incorrect input and returning misleading results, especially because insufficient-input prompts strongly influence user behavior.

Intent-Code Divergence

Low

• Confidence: 90% confidence
• Finding: The inline documentation says non-JSON input is treated as plain-text material such as '直接粘贴的合同全文', which contradicts the surrounding manifest and usage text that limit the skill to checking R&D expense detail tables with headers. This is an intent/documentation mismatch rather than an implementation necessity, because the rest of the file consistently frames the accepted material as the expense detail table.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The JSON value on L2 consists entirely of Chinese headers and entries, indicating a fixed language/locale. The file provides no natural-language indication that users can choose another language or that the Chinese-only format is required for a region-specific use case.

Static analysis

No suspicious patterns detected.