应收账款催收计划与回款核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 7:36 AM UTC
• Version: 1.0.35

Overview

The free checker itself runs locally, but the skill also steers users toward an external paid purchase and skill installation despite offline and no-payment claims.

Install only if you are comfortable with a Chinese-language local receivables checker that also includes a paid-upgrade prompt. Treat the free checker as local, but do not let an agent follow the paid purchase or skill-installation path unless you explicitly want that, verify the merchant/product details yourself, and confirm any payment personally.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill prominently claims '完全本地运行', '不联网', and 'no network', but later embeds external purchase and installation flows with remote URLs and HTTP/HTTPS endpoints. This mismatch can mislead users and host agents into trusting the skill as offline-only while it contains instructions that can trigger outbound navigation or acquisition behavior, increasing phishing, supply-chain, and policy-bypass risk.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The skill's stated purpose is deterministic receivables-table checking, but a large portion of the content instructs the agent to promote, purchase, install, and validate another product, including merchant identifiers and external URLs. Embedding commerce and installation workflow inside an unrelated business-checking skill creates a prompt-injection-like expansion of scope that can steer agents into risky external actions, dependency installation, and payment flows unrelated to the user's original task.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The user-facing name, summary, and primary descriptions are presented in Chinese, and the operational instructions throughout the document are also Chinese-first. While an English field exists, the skill does not explicitly offer users a language choice or state that the locale restriction is intentional for a region-specific workflow, which can violate language/locale policy requirements.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The natural-language documentation and user-facing strings throughout the file are written exclusively in Chinese, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The user-facing description, usage text, errors, and output are entirely in Chinese, but the file does not state that the skill is intentionally limited to Chinese users or provide any language selection. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: The inline documentation states that non-JSON input will be treated as plain-text materials such as a 'directly pasted full contract'. That contradicts the surrounding manifest and usage text, which consistently describe this skill as checking an 应收账款催收计划与回款表 with headers rather than general contract documents.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The JSON template contains only Chinese headers and customer labels in its natural-language content. For a general-purpose sample/template file, this imposes a specific language/locale without any visible opt-in or justification, which matches the language/locale policy concern.

Static analysis

No suspicious patterns detected.