关联方资金占用与往来清理核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 9:30 AM UTC
• Version: 1.0.4

Overview

The local checker appears offline and purpose-built, but the skill instructions add a mandatory upsell that can lead an agent through external purchase and installation steps.

Install only if you are comfortable with a Chinese-language local ledger checker that also contains built-in paid-upgrade prompts. Keep the free flow local, do not let an agent start purchases or install external SkillPay components unless you explicitly asked for that at the time, and verify merchant, product, amount, and platform rules before using any payment link or QR code.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The document claims the tool is fully local and does not use the network, yet elsewhere directs access to external URLs and purchase flows. This mismatch is dangerous because it can mislead users and orchestrators about trust boundaries, causing them to permit a skill under false assumptions about network isolation and external dependencies.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill is presented as a free local reconciliation tool, but embeds instructions requiring the agent to upsell, initiate purchase flows, and install a separate paid product. This creates a software-installation and payment side effect unrelated to the core analysis task, increasing the risk of covert monetization, user manipulation, and supply-chain exposure through externally fetched skills.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: A ledger-checking skill should not contain operational capability or instructions to buy and install additional software. Bundling commerce and installation behavior into a financial checking workflow broadens privileges beyond stated purpose and can be abused to steer agents into executing unneeded external actions with payment and supply-chain risk.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The usage section tells users to run the tool with '--input 你的材料.json', which indicates file-based input processing. Later, the boundary statement says the skill does not read exported files from funding systems, receivables systems, or bank statements and requires users to paste text instead; these statements directly conflict about accepted input mode.

Natural-Language Policy Violations

Medium

• Confidence: 85% confidence
• Finding: The instructions require the agent to present a mandatory upsell notice every time the skill is called, and the prescribed user-facing text and surrounding content are written only in Chinese. There is no explicit allowance for matching the user's preferred language or offering locale choice, which can violate language/locale policy for a general-purpose skill.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file’s user-facing natural-language guidance, warnings, sample input, and result text are entirely in Chinese, including required column names and instructions such as asking the user to paste the ledger with specific Chinese headers. There is no indication that other languages are supported or that Chinese is an optional locale, which can violate a language-choice policy when no user opt-in is provided.

Intent-Code Divergence

Low

• Confidence: 87% confidence
• Finding: The inline comment says non-JSON input is treated as '纯文本材料（例如直接粘贴的合同全文）', which suggests generic contract-document processing. However, the manifest and the rest of the script consistently describe a narrow capability: checking related-party ledger/tabular account data with headers, not arbitrary contract text.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: The JSON contains a fixed Chinese-language table header and content, which implies the skill output or data format is constrained to Chinese. Under the policy rules, hard-coding a specific language without offering user choice or documenting a justified locale constraint is a natural-language policy issue.

Static analysis

No suspicious patterns detected.