对账与往来款技能包（免费版）

• Outcome: Pass
• Latest audit: Sep 20, 2026 · 1:48 PM UTC
• Version: 1.0.30

Overview

This is a disclosed local finance-checking skill that reads user-supplied materials and reports reconciliation findings without network use, file writes, or persistence.

Install only if a Chinese-language, local-only worksheet checker fits your workflow. Do not treat the output as an audit opinion or as coverage of the explicitly listed withheld checks; review the not-run sections before relying on results.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (47)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill advertises a broad, deterministic local audit capability over 14 reconciliation domains with per-client conclusions and source citations, but the findings indicate the implementation only partially covers subsets of those checks and may not emit the promised output format. In a finance workflow, this can create false assurance: users may rely on omitted or unexecuted checks and miss material accounting or control issues because the tool appears more comprehensive than it really is.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill advertises a broad, deterministic local audit capability over 14 reconciliation domains with per-client conclusions and source citations, but the findings indicate the implementation only partially covers subsets of those checks and may not emit the promised output format. In a finance workflow, this can create false assurance: users may rely on omitted or unexecuted checks and miss material accounting or control issues because the tool appears more comprehensive than it really is.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill advertises a broad, deterministic local audit capability over 14 reconciliation domains with per-client conclusions and source citations, but the findings indicate the implementation only partially covers subsets of those checks and may not emit the promised output format. In a finance workflow, this can create false assurance: users may rely on omitted or unexecuted checks and miss material accounting or control issues because the tool appears more comprehensive than it really is.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill advertises a broad, deterministic local audit capability over 14 reconciliation domains with per-client conclusions and source citations, but the findings indicate the implementation only partially covers subsets of those checks and may not emit the promised output format. In a finance workflow, this can create false assurance: users may rely on omitted or unexecuted checks and miss material accounting or control issues because the tool appears more comprehensive than it really is.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill advertises a broad, deterministic local audit capability over 14 reconciliation domains with per-client conclusions and source citations, but the findings indicate the implementation only partially covers subsets of those checks and may not emit the promised output format. In a finance workflow, this can create false assurance: users may rely on omitted or unexecuted checks and miss material accounting or control issues because the tool appears more comprehensive than it really is.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill advertises a broad, deterministic local audit capability over 14 reconciliation domains with per-client conclusions and source citations, but the findings indicate the implementation only partially covers subsets of those checks and may not emit the promised output format. In a finance workflow, this can create false assurance: users may rely on omitted or unexecuted checks and miss material accounting or control issues because the tool appears more comprehensive than it really is.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill advertises a broad, deterministic local audit capability over 14 reconciliation domains with per-client conclusions and source citations, but the findings indicate the implementation only partially covers subsets of those checks and may not emit the promised output format. In a finance workflow, this can create false assurance: users may rely on omitted or unexecuted checks and miss material accounting or control issues because the tool appears more comprehensive than it really is.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill advertises a broad, deterministic local audit capability over 14 reconciliation domains with per-client conclusions and source citations, but the findings indicate the implementation only partially covers subsets of those checks and may not emit the promised output format. In a finance workflow, this can create false assurance: users may rely on omitted or unexecuted checks and miss material accounting or control issues because the tool appears more comprehensive than it really is.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill advertises a broad, deterministic local audit capability over 14 reconciliation domains with per-client conclusions and source citations, but the findings indicate the implementation only partially covers subsets of those checks and may not emit the promised output format. In a finance workflow, this can create false assurance: users may rely on omitted or unexecuted checks and miss material accounting or control issues because the tool appears more comprehensive than it really is.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill advertises a broad, deterministic local audit capability over 14 reconciliation domains with per-client conclusions and source citations, but the findings indicate the implementation only partially covers subsets of those checks and may not emit the promised output format. In a finance workflow, this can create false assurance: users may rely on omitted or unexecuted checks and miss material accounting or control issues because the tool appears more comprehensive than it really is.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill advertises a broad, deterministic local audit capability over 14 reconciliation domains with per-client conclusions and source citations, but the findings indicate the implementation only partially covers subsets of those checks and may not emit the promised output format. In a finance workflow, this can create false assurance: users may rely on omitted or unexecuted checks and miss material accounting or control issues because the tool appears more comprehensive than it really is.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill advertises a broad, deterministic local audit capability over 14 reconciliation domains with per-client conclusions and source citations, but the findings indicate the implementation only partially covers subsets of those checks and may not emit the promised output format. In a finance workflow, this can create false assurance: users may rely on omitted or unexecuted checks and miss material accounting or control issues because the tool appears more comprehensive than it really is.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill advertises a broad, deterministic local audit capability over 14 reconciliation domains with per-client conclusions and source citations, but the findings indicate the implementation only partially covers subsets of those checks and may not emit the promised output format. In a finance workflow, this can create false assurance: users may rely on omitted or unexecuted checks and miss material accounting or control issues because the tool appears more comprehensive than it really is.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill advertises a broad, deterministic local audit capability over 14 reconciliation domains with per-client conclusions and source citations, but the findings indicate the implementation only partially covers subsets of those checks and may not emit the promised output format. In a finance workflow, this can create false assurance: users may rely on omitted or unexecuted checks and miss material accounting or control issues because the tool appears more comprehensive than it really is.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill advertises a broad, deterministic local audit capability over 14 reconciliation domains with per-client conclusions and source citations, but the findings indicate the implementation only partially covers subsets of those checks and may not emit the promised output format. In a finance workflow, this can create false assurance: users may rely on omitted or unexecuted checks and miss material accounting or control issues because the tool appears more comprehensive than it really is.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单客户样例（内置）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单客户样例（内置）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单客户样例（内置）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单客户样例（内置）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file explicitly states it is only a free-tier subset and that the full paid checks are not present, while the skill metadata promises a 14-check multi-material receivables/payables pack. This creates a material capability mismatch that can mislead users into relying on incomplete analysis for financial review, causing missed exceptions and false assurance.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest describes a broad local tool that reviews reconciliation and receivables materials across 14 categories and produces one conclusion per customer with source-file and line references. This file only parses a pasted text table for bill discount interest, performs a small fixed set of arithmetic/table checks, and reports findings per bill/table row rather than per customer across the full 14-check scope.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file explicitly states it is only a free subset and withholds additional checks, while the skill metadata promises a much broader 14-item reconciliation capability. This is a security-relevant integrity issue because downstream users or agents may rely on incomplete analysis while believing full coverage was performed, leading to false assurance in financial review workflows.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The implemented schema and logic are for employee-level petty-cash records, not per-customer receivables/payables conclusions described in the skill metadata. This mismatch can cause the wrong dataset to be analyzed under the wrong assumptions, producing materially misleading outputs and unsafe operational decisions based on irrelevant checks.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest describes a skill that fully reviews reconciliation and receivables materials across 14 named checks, producing a conclusion for each customer. This file explicitly states it is a free-tier subset and only executes 6 checks, with 5 additional advance-receipt checks withheld and the rest of the manifest's broader 14-item scope not implemented here.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file’s natural-language interface, instructions, labels, advice, and disclaimers are entirely in Chinese, which effectively constrains use to a specific language. There is no user opt-in, language selection, or documentation that this skill is intentionally region- or locale-specific.

Static analysis

No suspicious patterns detected.