Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
销售返利与渠道返点核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
The rebate checker runs locally, but its skill instructions add a mandatory upsell path that can lead an agent into external payment and installing another skill.
Install only if you are comfortable with a Chinese-language local rebate checker that may prompt an upsell. Do not allow the agent to follow SkillPay purchase links, show payment QR codes, or install additional skills unless you explicitly intended to buy the paid version and have verified the merchant, product, amount, and platform rules yourself.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (12)
Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Natural-Language Policy Violations
Medium
- Confidence
- 89% confidence
- Finding
- The skill is presented almost entirely in Chinese, including the operational instructions that the agent is told to follow, while the English metadata is minimal and incomplete. There is no clear statement that the user may choose another language or locale, so the skill effectively imposes a language choice without opt-in.
Description-Behavior Mismatch
Medium
- Confidence
- 97% confidence
- Finding
- The document gives contradictory statements about whether over-redemption detection is included in the free version. Security-relevant capability mismatches are dangerous because they can cause users or downstream agents to rely on checks that are not actually performed, creating false assurance and missed accounting anomalies.
Description-Behavior Mismatch
Medium
- Confidence
- 97% confidence
- Finding
- The skill is presented as a local, free, no-network rebate-checking tool, but later instructs the agent to initiate an external purchase and installation flow for a paid version. This is a scope expansion and trust-boundary violation: a user invoking a bookkeeping checker may be unexpectedly funneled into commerce and external dependency installation, increasing phishing, social-engineering, and unauthorized action risk.
Intent-Code Divergence
Medium
- Confidence
- 88% confidence
- Finding
- The skill claims the only difference between versions is a set of extra checks, while also embedding operational behavior for purchasing and installing another product. That understatement obscures material behavioral differences and can mislead agents or users about what actions may be triggered beyond data analysis.
Context-Inappropriate Capability
Medium
- Confidence
- 98% confidence
- Finding
- The skill contains instructions to orchestrate e-commerce purchasing, follow external onboarding docs, install additional skills, and present payment links/QR codes, none of which are necessary for rebate-ledger checking. In a skill execution context, this creates a direct social-engineering and supply-chain risk by normalizing external transactions and dependency installation under the guise of a finance utility.
Natural-Language Policy Violations
Medium
- Confidence
- 97% confidence
- Finding
- This JavaScript file includes all user-facing natural-language documentation, guidance, and sample content in Chinese, with no indication that users may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
Natural-Language Policy Violations
Medium
- Confidence
- 95% confidence
- Finding
- The user-facing description, usage, prompts, and status messages are entirely in Chinese, which imposes a specific language/locale on users. The file does not indicate that Chinese is optional, user-selectable, or justified as a region-specific tool.
Natural-Language Policy Violations
Medium
- Confidence
- 97% confidence
- Finding
- The JSON value on L2 contains only Chinese-language tabular content, indicating the skill/template is constrained to a specific language or locale. Under the policy rules, forcing a language without user opt-in or documented justification is a natural-language policy violation.
Vague Triggers
Low
- Confidence
- 84% confidence
- Finding
- The manifest description lists trigger phrases including “返利台账对不上,” which is a natural-language complaint that could plausibly appear in ordinary conversation about reconciliation problems. The file does not provide exclusion conditions, invocation boundaries, or negative examples to clarify when the skill should or should not activate.
Intent-Code Divergence
Low
- Confidence
- 88% confidence
- Finding
- L077 的注释称“不是 JSON 就当作纯文本材料（例如直接粘贴的合同全文）”，但该技能整体声明和其余帮助文本都限定在销售返利/渠道返点台账核对，且后续提示也要求“返利台账（含表头）”。这会在文档层面暗示技能可处理合同全文，与实际聚焦的台账核对意图不一致。
Static analysis
No suspicious patterns detected.