公共费用与分摊技能包（免费版）

• Outcome: Pass
• Latest audit: Sep 20, 2026 · 3:03 PM UTC
• Version: 1.0.21

Overview

This is a local business reconciliation skill that reads user-provided files and prints audit-style findings; I found no hidden network use, file writing, persistence, or privilege escalation.

Install only if you are comfortable running a local Node-based checker over store/accounting files. It appears designed for Chinese-language tabular materials and does not replace accounting, audit, tax, banking, insurance, or invoice-authenticity review.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 该代码的主功能与声明描述明显不符。描述聚焦“门店费用材料、6项公共费用、逐门店核对”，而代码从常量命名、表头识别、计算公式、检查项到返回结果都围绕“保险代理手续费与佣金结算”展开，检查的是保费、手续费率、应收手续费、退保追回、代扣税费、实收净额等保险佣金结算字段。虽然两者都属于‘核对表格并输出行号问题’这一抽象范畴，但业务领域、输入格式、检查逻辑、输出粒度均发生了实质性偏离，因此应判定为描述与行为不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 该描述与代码的核心用途明显不一致。描述说的是“门店费用材料按6项公共费用逐门店核对”，听起来像门店层面的费用审阅/对账工具；但代码完整围绕“收款手续费”表格展开，字段要求包括渠道、交易金额、费率、固定费、应收手续费、账单手续费、结算金额、差异，且所有校验逻辑都服务于支付渠道手续费计算与对账。它既不按门店建模，也没有实现‘6项公共费用’这一业务语义。虽然代码确实不付款、不注册、也会给出行号，但这些只是局部符合，不能掩盖主功能的实质偏差，因此应判定为描述与行为不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 该描述与代码主用途存在明显不一致。声明描述的是门店公共费用材料核对，按门店给出6项费用结论；而代码从文件名、注释、表头映射、必需字段到校验逻辑，都围绕“废料边角料销售与回收结算”展开。它要求输入的是废料台账文本，并检查结算数量、金额、台账收入、结存、重复过磅单号等，完全不是公共费用核对。虽然代码确实不会付款、注册，也会返回行号，但这些只是局部特征，不能掩盖核心业务能力与声明场景的实质性偏离。因此应判定为描述与实际行为不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: 核心能力有部分重合：都是对费用表进行核对，且代码确实不涉及付款、注册，也会输出带行号的证据。但描述与实际行为存在实质差异。最重要的是，代码自述为“免费档子集”，只执行 4 项检查，且把若干关键分摊占比类检查明确列为未执行；这与“按 6 项公共费用核对逐门店核一遍”不符。其次，代码针对的是物业向租户分摊电费、水费、物业费的表格算术校验，不是通用的门店费用材料逐店审核。输出形式也不是每店仅一行结论，而是详细问题清单加汇总。因此应判定为描述与行为不完全一致，存在明显能力与用途层面的失配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: 两者存在明显的用途偏差。描述面向门店公共费用材料审核，听起来像广义费用单据核查；但代码专门针对水电抄表账单，核心字段和逻辑都是“表号/读数/用量/单价/应收金额”的算术复核。虽然二者都属于‘费用核对’范畴，且都不涉及付款、注册、网络请求，但主任务对象、检查维度和输出形态都不一致，属于实质性描述-行为不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 两者主用途存在明显偏差。声明描述的是面向“门店”的“6项公共费用”审核工具，而代码从文件头注释、字段定义、校验公式到输出总结都明确围绕“仓储费与超期费”展开，不是通用公共费用，也不是门店费用核对。代码依赖特定仓储账单列名并执行仓储费=数量×单价×天数、超期费=数量×费率×天数等专门逻辑，这与声明中的业务对象和核对内容均不一致。虽然代码确实会输出行号，且未涉及付款/注册，但这些只是局部吻合，不能掩盖其主要能力与声明严重不符。

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单门店样例（内置，6 项全跑）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单门店样例（内置，6 项全跑）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单门店样例（内置，6 项全跑）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单门店样例（内置，6 项全跑）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The implementation clearly performs insurance agency commission reconciliation while the manifest describes a store shared-cost checking skill. This kind of capability/manifest mismatch is dangerous because downstream users, orchestrators, or policy gates may route sensitive business data to the wrong parser and trust incorrect outputs, causing silent misprocessing and false conclusions.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The exported checks, required columns, and output semantics are for insurance commission rows, periods, and settlement math rather than per-store shared-cost conclusions promised by the manifest. If deployed under the wrong identity, callers may supply unrelated store-expense documents and receive authoritative-looking but irrelevant or empty results, undermining integrity and potentially driving bad financial decisions.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The implementation materially diverges from the declared skill purpose: the metadata says it cross-checks six categories of shared store expenses per store, while this module instead analyzes payment-channel processing fees. That kind of scope mismatch can cause the agent to run the wrong logic on sensitive financial records, producing misleading conclusions and undermining trust, auditability, and downstream decisions.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The implementation materially diverges from the declared skill purpose: the metadata says it cross-checks six categories of shared store expenses per store, while this module instead analyzes payment-channel processing fees. That kind of scope mismatch can cause the agent to run the wrong logic on sensitive financial records, producing misleading conclusions and undermining trust, auditability, and downstream decisions.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file’s implementation and embedded documentation clearly describe a scrap-sale reconciliation engine for manufacturing/construction waste settlement, not the manifest-declared shared-cost per-store review workflow. This mismatch is dangerous because a caller may trust the skill metadata and unknowingly run unrelated financial logic, producing incorrect conclusions, data misuse, or compliance/audit errors under a false label.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The declared contract and required fields expect scrap-sale ledger columns such as weigh tickets, impurity, moisture, settlement price, and recovery income, which conflict with the manifest’s promised six shared-cost checks per store. In a security context, this is a functional integrity vulnerability: downstream agents or users can be induced to provide the wrong data and rely on invalid outputs, causing silent business-process compromise rather than a code-execution issue.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill metadata promises a general store shared-cost review across six public expense categories, but this file only processes a narrowly defined warehouse-fee table with fixed storage/overdue columns. This mismatch can cause users or downstream agents to rely on the tool for broader expense validation than it actually performs, leading to missed financial errors and false assurance.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The top-level natural-language comments, sample inputs, labels, and user-facing advice are all written in Chinese, and the contract/messages indicate the tool expects Chinese column names such as “交易金额”, “费率”, and “账单手续费”. There is no opt-in, alternative locale support, or justification that this skill is intentionally region-specific, so this is a language/locale policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file’s descriptive comments, sample data, role labels, parsing rules, and returned user-facing messages are all written in Chinese, indicating the skill is designed to operate only in Chinese. There is no visible opt-in, locale choice, or justification that this is a region-specific compliance tool, so this constitutes a language/locale policy issue.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The file’s natural-language instructions, sample input requirements, and user-facing messages are entirely in Chinese, including required field names and remediation text. There is no indication that the skill is region-specific or that users may opt into another language, which can violate language/locale policy for generally applicable skills.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The manifest says the output should be one conclusion per store, but the code emits row-level findings for customers/batches and summary totals instead. In an automated workflow, this semantic mismatch can break downstream review logic or cause store-level decisions to be made from incomplete or misgrouped data.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file’s natural-language documentation, user-facing messages, sample data, and operational guidance are entirely in Chinese, which effectively constrains the skill to a specific language/locale. The policy only allows this when the skill offers language choice or clearly documents a justified region-specific constraint, neither of which appears here.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This code file contains extensive natural-language strings that effectively force a specific language/locale for all users. Under the policy, a skill should not require a specific language unless it offers user opt-in or clearly documents a justified regional constraint.

Intent-Code Divergence

Low

• Confidence: 75% confidence
• Finding: The comment states that `CHECKS_WITHHELD` is only explanatory text and '不是实现'. However, the runtime appends those withheld checks into `checks_not_run` and also returns them in `checks_withheld`, creating a behavior that partially operationalizes the withheld list in outputs despite the documentation saying it is not an implementation.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The JSON text payload contains only Chinese-language instructions/data labels and does not indicate that the skill is region-specific or that users may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.

Static analysis

No suspicious patterns detected.