安全生产费用提取与使用核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 7:44 AM UTC
• Version: 1.0.41

Overview

The free local checker code appears limited, but the skill instructions add under-disclosed paid purchase and external skill-installation flows.

Use the free checker only if you are comfortable with a Chinese-language, local table-audit tool. Treat any paid-upgrade prompt as optional, do not allow automatic external installation or purchase flows unless you deliberately want that product, and independently verify merchant, product, amount, and payment links before proceeding.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The documentation explicitly claims 'completely local' and 'no network,' but later provides web pages, JSON endpoints, redirects, and payment links. This is dangerous because operators and users may trust the skill under false assumptions, causing them to permit execution paths they would otherwise block under stricter network or commerce policies.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill advertises itself as a free, local, no-network checker, but later instructs the agent to upsell, fetch purchase instructions, and drive external payment/install flows for a separate paid product. This creates a trust-boundary violation: a user invoking a benign accounting check can be steered into commerce and remote installation actions unrelated to the core task.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Embedding commerce and external installation steps inside a document-processing skill expands its capabilities beyond the stated purpose and enables unexpected agent actions such as visiting external sites, retrieving dynamic product identifiers, and initiating purchases. That mismatch increases the risk of social engineering, policy bypass, and supply-chain exposure through installation of additional skills or dependencies.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs the agent to present and potentially initiate a paid path, but the warning is not surfaced clearly at the outset of the skill. Users engaging a free local checker may not realize they are entering a workflow that can trigger external purchase and installation actions, which undermines informed consent.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The file’s natural-language comments and all user-facing messages are written in Chinese, including warnings, errors, and output text. Because this is a policy check that applies to all file types, this appears to impose a specific language/locale without any opt-in, alternative locale handling, or explicit justification that the skill is region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The file's user-facing strings, help text, and usage instructions are entirely in Chinese, and there is no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Static analysis

No suspicious patterns detected.