阶梯提成与销售业绩核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 7:44 AM UTC
• Version: 1.0.41

Overview

The bundled checker appears local, but the skill also requires an agent to promote and potentially run an external paid purchase and installation flow.

Treat this as a local Chinese-language sales commission checker only if you install it. Do not allow the agent to fetch dynamic purchase links, initiate payment, or install the paid follow-up skill unless you explicitly intend to buy it and independently verify the merchant, product, amount, and platform rules. The local bundled code itself did not show network use or persistence.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The manifest and description claim the skill is local-only, requires no network, and needs no registration, but the body includes instructions for external purchasing, installation, and network URLs. This mismatch is dangerous because users and orchestrating agents may grant the skill more trust than warranted, enabling deceptive upsell or unexpected outbound actions under a false 'offline-only' representation.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The documentation says the skill runs completely locally and does not access the network, but later sections instruct network-based purchase and installation actions. This contradiction is dangerous because it undermines informed consent and can bypass user caution or policy controls that rely on the skill's advertised offline behavior.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The skill includes mandatory e-commerce orchestration, purchase prompting, payment-link handling, and installation instructions that are unrelated to verifying commission sheets. Embedding transactional workflow inside a business-audit skill expands scope and creates a social-engineering channel where an agent may pressure users into purchases or follow external instructions during a routine audit task.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The skill’s visible name, summary, primary descriptions, and usage guidance are predominantly in Chinese, and the instructions do not offer the user a choice of language for interaction or output. This can violate the language/locale policy criterion because it effectively imposes a specific language without explicit opt-in, despite having only a minimal English description field.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The description says '触发词包括' followed by two phrases, which implies the list may be non-exhaustive and does not define when the skill should not activate. While the phrases are somewhat domain-specific, the manifest lacks explicit scope constraints, negative examples, or a complete trigger list, making invocation conditions ambiguous for a markdown/manifest file.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill directs the agent to use external purchase pages, a dynamic JSON product lookup endpoint, and redirect links that are unnecessary for the declared local checking function. This creates a supply-chain and phishing risk because the agent is encouraged to trust mutable external endpoints and use changing product identifiers during a task that users expect to be deterministic and offline.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file’s natural-language comments, guidance, sample data, labels, and user-facing messages are entirely in Chinese, and there is no indication that the skill supports another language or lets the user choose a locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: User-facing strings, comments, usage text, and errors are presented entirely in Chinese, which effectively imposes a specific language on users. The file does not offer an opt-in language selection or explain that the skill is intentionally limited to a Chinese-speaking or region-specific context.

Intent-Code Divergence

Low

• Confidence: 90% confidence
• Finding: The inline documentation states that non-JSON input is handled as plain-text material, giving '直接粘贴的合同全文' as an example. That contradicts the surrounding manifest and script intent, which consistently describe this skill as operating on a sales commission/performance reconciliation table with headers, not arbitrary contract text.

Static analysis

No suspicious patterns detected.