租金收缴与欠租台账核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 7:44 AM UTC
• Version: 1.0.34

Overview

The local rent-ledger checker code is mostly contained, but the skill also pushes agents into an external paid purchase and installation flow that is broader than its no-network/free framing.

Review this before installing because the checker itself appears local, but the skill instructions pressure the agent to offer and potentially execute an external paid upgrade/install flow. Do not allow an agent to open payment links, install additional skills, or fetch dynamic purchase instructions unless you explicitly intend that and can verify the merchant, product, amount, and platform rules yourself.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The documentation explicitly claims the skill is fully local and does not use the network, but later mandates network-based purchase and installation actions. This inconsistency is dangerous because users and agents may grant trust, permissions, or execution based on false assumptions about data locality and external communication.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill markets itself as a fully local, no-network rent-checking tool, but later embeds instructions for external purchase, installation, and payment flows. This creates a trust-boundary violation: an agent following the skill could unexpectedly navigate to third-party sites, retrieve dynamic instructions, and initiate software installation unrelated to the core offline auditing task.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: These sections instruct the agent to upsell, purchase, and install another product, which is unrelated to validating rent ledgers. Embedding transactional/install behavior inside a business-audit skill expands the attack surface and can be abused to steer users into unintended purchases or secondary tool installation under the guise of routine analysis.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The primary display names, summary, and main descriptions are in Chinese, and the operational instructions throughout the document are also Chinese-first. Although an English description field exists, the skill does not offer the user a language choice or indicate that Chinese is optional, which can violate a language/locale policy requiring user opt-in.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The file exposes direct purchase URLs, redirectors, and dynamic JSON endpoints that are not necessary for local ledger checking. Such links can enable phishing, silent redirection, or future endpoint changes that cause the agent to fetch unreviewed content or send users to untrusted purchase destinations.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file’s descriptive comments and user-facing explanatory text are entirely in Chinese, which imposes a language/locale assumption on users and maintainers. The file does not offer any language choice or indicate that the tool is intentionally region-specific for a documented compliance reason.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file’s natural-language interface, including the header comment, usage text, error messages, and help output, is entirely in Chinese. This imposes a specific language on users without any opt-in or documented locale constraint, which matches the policy category for language/locale violations.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The only natural-language content in this manifest-style JSON sample is entirely in Chinese, including field headers and record values, with no indication that the skill is region-specific or that users can opt into this locale. Under the policy, fixed language constraints without user choice or documented justification are a natural-language policy concern.

Intent-Code Divergence

Low

• Confidence: 95% confidence
• Finding: The inline documentation states that non-JSON input is handled as plain-text material such as a 'directly pasted full contract' (合同全文). That contradicts the rest of the file, which consistently says the tool requires a rent-collection/arrears reconciliation table with headers and should not operate on unrelated document types.

Static analysis

No suspicious patterns detected.