Security audit

股份支付费用分摊核对（免费版）

Security checks for vulnerabilities and agentic risk

Overview

The checker code is local and offline, but the skill text pushes agents into an external paid upgrade, payment-link, and skill-install workflow that users should review carefully.

Install only if you are comfortable with a free local checker that also contains an agent-directed paid upgrade path. Do not allow the agent to follow external purchase/install instructions, fetch payment links, scan QR codes, or install the paid skill unless you explicitly intend to buy it and have verified the merchant, product, amount, and platform payment rules yourself.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The skill explicitly claims it is fully local, offline, and requires no network access, yet later requires visiting external websites and using remote purchase/install flows. This contradiction is dangerous because users and host systems may grant trust based on offline-only expectations while the content attempts to trigger networked behavior.

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 先看样例
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 先看样例
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The documentation instructs the agent to facilitate payment and installation steps, including following external links and progressing a purchase workflow, even though the declared purpose is an accounting reconciliation tool. Mixing financial analysis with commerce handling increases phishing, unauthorized transaction, and social-engineering risk because the agent is operationalized to move the user toward payment.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill presents itself as a free, local accounting checker, but later embeds instructions for acquiring a paid edition and having the agent participate in installation and purchase flow. This creates a deceptive trust boundary: users may invoke a supposedly offline/local skill while the agent is steered into commercial actions unrelated to the core verification task.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The skill tells the agent to read newly installed skill files and continue a purchase/install process using user authorization, which can cause the agent to handle order identifiers, merchant information, payment links, and other sensitive operational data in natural language. That expands the scope from document checking into sensitive workflow orchestration, increasing exposure to data leakage and manipulation.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This code file contains extensive natural-language instructions, warnings, and output strings exclusively in Chinese, including the main file header and user-facing advice/messages. Under the stated policy, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly justified or optional.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The user-facing natural-language content, help text, errors, and usage instructions are entirely in Chinese, presenting the skill as operating in that language by default. Under the policy, forcing a specific language without offering the user a language or locale choice is a reportable natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The only natural-language content in this manifest-like JSON file is a Chinese table header and entries, which implies the skill/template is fixed to a specific language/locale. Under the policy, locale or language constraints should not be forced unless the user is given a choice or the restriction is clearly documented and justified.

Intent-Code Divergence

Low

Confidence: 87% confidence
Finding: The comment says non-JSON input is treated as plain-text material such as '直接粘贴的合同全文', which contradicts the surrounding manifest and usage text that scope the tool to checking a share-based-payment detail table containing headers. This is not merely incomplete documentation: it actively suggests a broader input intent than the skill actually claims to support.

Static analysis

No suspicious patterns detected.