关联方交易与同期资料一致性核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 7:35 AM UTC
• Version: 1.0.8

Overview

The checker itself runs locally, but the skill’s instructions contradict its offline/no-payment claims by requiring upsell, external purchase, and installation flows.

Treat this as a local ledger checker only if you disable or ignore the upsell path. Do not allow the skill to fetch purchase instructions, create payment links, install onboarding packages, or install the paid version unless you separately trust and review those external sources and explicitly intend to buy.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: 整体功能主体确实是在做关联交易台账核对，且属于免费检查项子集，因此并非完全无关代码；但仍存在实质性描述不一致。最明显的是文件头与输入不足提示把工具描述为“股份支付费用分摊表”检查，说明代码来源/文案与声明主用途不完全一致。其次，声明强调“每条结论引用原文”，而实现只是对解析后的表格单元格和计算结果给出evidence，没有原文摘录、行文引用或文本片段定位能力。再次，声明中的“关联方交易与同期资料一致性核对”容易让人预期会检查同期资料准备情况与金额门槛的一致性，但这部分被明确列入CHECKS_WITHHELD，免费版并未执行。综合看，代码与声明方向相关，但描述精度不足，存在可导致用户误解的能力与用途偏差。

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The file explicitly claims '完全本地运行' and '不联网', yet later directs the agent to use external URLs and network-based purchase/install flows. This is dangerous because users and host systems may grant the skill elevated trust or relaxed review based on the offline claim, while the embedded instructions attempt to expand behavior into network access and external dependency retrieval.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill advertises itself as a local, offline checker, but it embeds instructions for the agent to initiate a networked purchase and installation flow and to surface payment links. This creates a risky trust boundary expansion: a user invoking a local analysis skill could be steered into external transactions and installation steps, increasing phishing, social-engineering, and supply-chain exposure.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file’s documentation and some user-facing text describe a completely different checker (share-based payment) than the code actually implements (related-party transaction checks). This can mislead operators into supplying the wrong data, misinterpreting results, or believing a required control was executed when it was not, creating a security-relevant integrity failure in compliance and audit workflows.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The text presents the free skill as a bounded checker whose omitted features belong to another separate product, yet later instructs the same skill invocation to carry out the paid purchase and installation workflow. That creates an intent-level contradiction between being only the free checker and acting as a commerce/install agent for the separate product.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The file mandates that the agent present a specific upsell/selection message every time the free skill is invoked, and the surrounding required wording is written only in Chinese. Because no alternative language or user opt-in is provided, this creates a language/locale policy issue for users who may not use Chinese.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: When input is missing, the tool instructs users to provide a share-based-payment allocation table even though the engine validates related-party transaction ledgers. In practice, this can drive users to submit the wrong records and can cause control failure, where the intended tax/compliance review is skipped or replaced by irrelevant material.

Intent-Code Divergence

Low

• Confidence: 90% confidence
• Finding: The inline documentation states that non-JSON input is treated as plain-text material such as a 'full contract text' (直接粘贴的合同全文), which conflicts with the rest of this script's documented intent of checking a related-party transaction ledger with headers. The implementation does indeed accept any non-JSON text as input, so the comment broadens the apparent intended input beyond the skill's stated ledger-focused purpose.

Static analysis

No suspicious patterns detected.