Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看样例
Security audit
SaaS订阅收入确认核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local, read-only revenue table checker with disclosed free-edition limits and no evidence of network access, persistence, or hidden behavior.
Install only if you are comfortable using a Chinese-language, local Node-based checker and understand that the free edition does not perform the listed withheld checks or replace accounting judgment.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看样例
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill metadata and body make inconsistent claims about what the free version actually checks, creating a deceptive capability boundary. In a finance-related validation skill, users may rely on omitted controls being present and make accounting decisions based on incomplete review coverage, which can cause material errors or false assurance.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The documentation asserts that editions differ only by a listed set of omitted checks, while earlier language broadly promises duplicate detection and row-level verification that overlaps with excluded functionality. This inconsistency can mislead users into trusting the tool for controls it may not perform, especially dangerous in revenue-recognition workflows where coverage gaps can hide accounting misstatements.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JavaScript file contains all natural-language comments, prompts, insufficiency messages, findings, notes, and disclaimers in Chinese only. Under the policy rule, forcing a specific language without user opt-in is a locale/language policy violation, and the file does not document any user choice or justified regional limitation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The user-facing title, usage text, help output, and runtime messages are entirely in Chinese, with no indication that other languages are supported or that Chinese is a required locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This JSON manifest/template contains only Chinese-language field labels and sample content, which indicates a fixed language/locale choice. Under the policy rule, locale-specific behavior should either offer user choice or clearly document why the restriction is justified.
- Content