会员积分与储值卡核销核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 7:38 AM UTC
• Version: 1.0.39

Overview

The local reconciliation checker itself is coherent, but the skill also tells agents to upsell, open external purchase links, and install a paid product, so it needs Review before installation.

Use this only if you want the bundled local free checker and are comfortable ignoring or disabling the upsell. Do not let an agent open purchase links, fetch dynamic purchase data from the raw IP endpoint, install SkillPay onboarding, or initiate payment unless you explicitly intended to buy the paid product and have independently verified the merchant, product, amount, and platform rules.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The documentation explicitly claims the skill is fully local and does not use the network, yet later directs the agent to open external URLs and perform online purchase and installation steps. This mismatch is dangerous because it undermines user trust and can bypass expectations or policy controls that rely on the declared local-only behavior.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill is presented as a free local reconciliation checker, but it embeds instructions for the agent to upsell, initiate purchases, fetch payment resources, and continue installation of a separate paid product. This creates a hidden commerce workflow inside an operational skill, increasing the risk of unauthorized external actions, phishing-like redirection, and user confusion about what the agent is allowed to do.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The visible skill instructions and operational guidance are almost entirely written in Chinese, including mandatory agent-facing workflow requirements. Although an English display name and brief description exist in metadata, the main usage and policy content does not offer users or agents a language choice, which can amount to a locale/language policy violation when applied broadly.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill’s stated purpose is reconciling member points and stored-value tables, but it also directs the agent to conduct sales and payment orchestration. That is an unjustified capability expansion, which broadens the attack surface and can pressure agents into performing sensitive actions unrelated to the core business function.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The file’s natural-language instructions and user-facing guidance are entirely in Chinese, with no indication that language is selectable or based on user preference. Under the stated policy, forcing a specific language or locale without opt-in is a natural-language policy violation.

Intent-Code Divergence

Low

• Confidence: 93% confidence
• Finding: The inline documentation says non-JSON input is treated as plain-text material and gives '直接粘贴的合同全文' as an example, which contradicts the surrounding manifest and file-level documentation that this skill is specifically for member-points/stored-value-card reconciliation tables. The implementation otherwise consistently expects a reconciliation table, so this comment misstates the intended input domain.

Static analysis

No suspicious patterns detected.