收入确认与结算技能包（免费版）

• Outcome: Pass
• Latest audit: Sep 20, 2026 · 1:50 PM UTC
• Version: 1.0.21

Overview

This is a local financial worksheet checker that reads user-provided project files and shows no network, file-writing, or persistence behavior.

Install only if you are comfortable running a Chinese-language local checker over financial/project materials. Point it only at the intended project directory, and treat results as arithmetic and consistency checks, not accounting, audit, tax, or legal conclusions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Advertising project-level revenue-recognition review but actually running store-sales report consistency checks is a material behavior mismatch. In this business-ops context, the main danger is not code execution but misplaced trust: users may believe month-end revenue controls were completed when only a narrow sales-report validation occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Advertising project-level revenue-recognition review but actually running store-sales report consistency checks is a material behavior mismatch. In this business-ops context, the main danger is not code execution but misplaced trust: users may believe month-end revenue controls were completed when only a narrow sales-report validation occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Advertising project-level revenue-recognition review but actually running store-sales report consistency checks is a material behavior mismatch. In this business-ops context, the main danger is not code execution but misplaced trust: users may believe month-end revenue controls were completed when only a narrow sales-report validation occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: Advertising project-level revenue-recognition review but actually running store-sales report consistency checks is a material behavior mismatch. In this business-ops context, the main danger is not code execution but misplaced trust: users may believe month-end revenue controls were completed when only a narrow sales-report validation occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Advertising project-level revenue-recognition review but actually running store-sales report consistency checks is a material behavior mismatch. In this business-ops context, the main danger is not code execution but misplaced trust: users may believe month-end revenue controls were completed when only a narrow sales-report validation occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Advertising project-level revenue-recognition review but actually running store-sales report consistency checks is a material behavior mismatch. In this business-ops context, the main danger is not code execution but misplaced trust: users may believe month-end revenue controls were completed when only a narrow sales-report validation occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Advertising project-level revenue-recognition review but actually running store-sales report consistency checks is a material behavior mismatch. In this business-ops context, the main danger is not code execution but misplaced trust: users may believe month-end revenue controls were completed when only a narrow sales-report validation occurred.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单项目样例（内置，7 项全跑）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单项目样例（内置，7 项全跑）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单项目样例（内置，7 项全跑）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单项目样例（内置，7 项全跑）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The implementation is for software-license and cloud-cost checking, while the skill metadata promises a 7-item revenue-recognition review. This mismatch can cause users to submit sensitive financial materials under false expectations, producing incorrect analyses and potentially omitting the controls they actually needed.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The implementation materially diverges from the skill metadata: it performs a narrow store sales cross-footing check instead of the promised 7-item project revenue-recognition and settlement review. This can cause users to rely on the tool for controls it does not perform, creating silent audit gaps and incorrect compliance conclusions.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The natural-language documentation and user-facing guidance are entirely in Chinese, including operational instructions and disclaimers, with no indication that users may choose another language. Under the stated policy, forcing a specific language without opt-in is a locale/language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The file’s user-facing natural-language comments, labels, advice, disclaimer, and result note are entirely in Chinese, indicating the skill is designed to operate in a single language. There is no documented user opt-in, locale selection, or explicit justification that this is a region-specific skill, so this creates a language/locale policy concern under the natural-language policy rule.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file’s user-facing natural-language strings, comments, labels, sample input, error messages, and result text are entirely in Chinese, and there is no indication that the user can opt into another language or that the skill is restricted to a Chinese-speaking or region-specific context. This creates a language/locale policy issue because the skill effectively enforces one language by default.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file’s user-facing natural-language comments, prompts, advice, sample headers, findings, and disclaimer are all written in Chinese, and there is no indication that users may interact in another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified as region-specific, which is not documented here.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: This JavaScript file contains extensive user-facing natural-language comments and returned advice/messages exclusively in Chinese, indicating the skill is designed around a fixed language/locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The header says this file is a free-tier subset that only implements free checks and that CHECKS_WITHHELD is merely descriptive text, not implementation. However, the code implements and runs several checks beyond the four core pain-point checks described earlier, such as duplicate-row detection, total-row reconciliation, placeholder detection, negative-value detection, and inverted-date detection, creating a mismatch between documentation and actual behavior.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The returned result structure is a multi-finding ledger audit format, not the manifest-promised per-project one-line conclusion with source citations. This can break downstream automation, cause consumers to trust incompatible output, and hide that required revenue-recognition conclusions were never produced.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This file contains extensive natural-language instructions, descriptions, and output text exclusively in Chinese, including the contract, scope notes, and user advice. Because no opt-in, language selection, or region-specific justification is provided, it can violate a policy requiring skills not to force a specific language or locale by default.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The metadata promises conclusions backed by original documents and line numbers, but the code only reports row numbers within a pasted text table and does not track source files. That mismatch can mislead users into thinking outputs are traceable to evidentiary source material when they are not, weakening auditability and review integrity.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file’s natural-language documentation, usage contract, warnings, and user-facing result strings are all written exclusively in Chinese, with no opt-in or indication that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the language/locale policy, forcing a specific language without user choice is a policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The user-facing description, usage text, prompts, and result messages are entirely in Chinese, and the skill does not indicate any option to choose another language or locale. This can violate a language/locale policy when users are not explicitly opted into Chinese-only interaction.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: This manifest-style JSON file contains user-facing natural-language content entirely in Chinese, with no indication that the language is optional or region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Static analysis

No suspicious patterns detected.