Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
SaaS订阅收入确认核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
The local checker code appears self-contained, but the skill also instructs agents to run an external paid purchase and installation flow that conflicts with its no-payment, no-network framing.
Review before installing. The local checker itself appears to process provided table text locally, but do not let an agent follow the paid-upgrade, external link, payment, or additional-skill installation instructions unless you explicitly intend that purchase and have independently verified the merchant, package, and platform rules.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (12)
Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Description-Behavior Mismatch
High
- Confidence
- 98% confidence
- Finding
- The skill markets itself as a fully local, no-network free checking tool, yet later instructs the agent to initiate external purchase, installation, and payment-link handling flows. That mismatch can mislead the host agent into performing networked commerce actions unrelated to the core audit task, expanding the trust boundary and enabling unwanted payment or supply-chain interactions.
Context-Inappropriate Capability
High
- Confidence
- 97% confidence
- Finding
- The embedded upsell workflow instructs the agent to guide purchases, retrieve external instructions, and continue installation after payment, which is outside the stated purpose of revenue-recognition validation. In a security context this is dangerous because a data-checking skill is being used to induce commerce actions and external dependency installation, creating phishing, payment-abuse, and remote-content risks.
Intent-Code Divergence
Medium
- Confidence
- 94% confidence
- Finding
- The main description says the skill performs '重复与空缺检测' as part of the free check scope. Later, the '需要完整档时（可选）' section says '同一合同重复建行' detection is not included in the free version. These statements conflict about whether duplicate detection is actually part of the free skill.
Vague Triggers
Medium
- Confidence
- 87% confidence
- Finding
- The manifest says the trigger words include “SaaS订阅收入确认核对” and “SaaS订阅收入确认表对不上,” but it does not define when the skill should not activate or provide negative examples. Although the phrases are somewhat domain-specific, the activation description still leaves ambiguity about whether any mention of these phrases should invoke the skill or only explicit requests for a table check.
Whitespace Padding
Medium
- Category
- Prompt Injection
- Content
输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。 执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致； ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。
- Confidence
- 80% confidence
- Finding
- Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Natural-Language Policy Violations
Medium
- Confidence
- 98% confidence
- Finding
- This JavaScript file contains the primary descriptive comments and user-facing guidance entirely in Chinese, including the top-of-file description and operational instructions. The policy for natural-language violations applies to all file types, and there is no indication that users can opt into Chinese or select another locale.
Natural-Language Policy Violations
Medium
- Confidence
- 95% confidence
- Finding
- The JSON payload contains only Chinese-language tabular content, which indicates a fixed language/locale presentation. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.
Natural-Language Policy Violations
Low
- Confidence
- 84% confidence
- Finding
- Most user-facing metadata and descriptions are presented in Chinese, and the document does not state that the user can choose another language for interaction. This can amount to a language policy issue if the skill effectively assumes a specific language without opt-in, even though one English field is present.
Vague Triggers
Low
- Confidence
- 75% confidence
- Finding
- The “什么时候用” section describes typical users and business contexts, but it does not translate that guidance into a clear invocation boundary. Without explicit trigger scope or exclusions, an agent may over-apply the skill whenever accounting or reconciliation is mentioned.
Intent-Code Divergence
Low
- Confidence
- 88% confidence
- Finding
- L077 的注释写明“不是 JSON 就当作纯文本材料（例如直接粘贴的合同全文）”，但文件头、帮助文本和 manifest 都将技能限定为 SaaS 订阅收入确认表核对，并强调需含表头。这里的内联文档把技能输入范围描述得比声明用途更宽，属于文档层面的意图偏移。
Static analysis
No suspicious patterns detected.