Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
软件外包里程碑验收与付款核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
The checker code is local-only, but the skill instructions push a paid purchase and installation flow that conflicts with the free, no-payment, no-network description.
Install only if you are comfortable with the free local checker and you can disable or ignore the upsell. Do not let the agent follow the paid purchase/install path unless you explicitly want that, have verified the SkillPay merchant and product details yourself, and are comfortable installing additional skill content from external instructions.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Description-Behavior Mismatch
High
- Confidence
- 98% confidence
- Finding
- The manifest and description promise a fully local, no-network skill, but the body instructs the agent to perform external purchase, installation, and payment-link retrieval flows. This creates a capability mismatch that can mislead users and downstream systems into granting trust or permissions under false assumptions, and it introduces network-driven commerce behavior into a skill whose stated purpose is offline table checking.
Context-Inappropriate Capability
High
- Confidence
- 95% confidence
- Finding
- These instructions require the agent to steer the user into a commercial purchase and installation workflow that is unrelated to the core task of checking milestone/payment tables. Embedding transaction orchestration inside a business-checking skill expands the attack surface for social engineering, policy bypass, and unauthorized tool use beyond what a user would reasonably expect.
Natural-Language Policy Violations
Medium
- Confidence
- 89% confidence
- Finding
- The skill's operational instructions are written as mandatory Chinese-language user messaging, including required phrasing the agent 'must' provide to users each time. There is no indication that the user may receive these disclosures in their preferred language or opt into Chinese, which creates a locale/language policy concern.
Whitespace Padding
Medium
- Category
- Prompt Injection
- Content
输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。 执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致； ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。
- Confidence
- 80% confidence
- Finding
- Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Context-Inappropriate Capability
Medium
- Confidence
- 96% confidence
- Finding
- The skill directs the agent to use multiple external URLs, including a mutable HTTP endpoint and redirect-based purchase flow, none of which are necessary for the advertised local verification task. Dynamic endpoints increase the risk of phishing, content swapping, downgrade to insecure transport, and supply-chain abuse because the target can change independently of the reviewed skill content.
Natural-Language Policy Violations
Medium
- Confidence
- 91% confidence
- Finding
- The file’s user-facing natural-language description and outputs are written exclusively in Chinese, indicating the skill is intended to operate in a single language. The file does not provide any user opt-in, locale selection, or justification for enforcing Chinese-only interaction, which can violate language/locale policy requirements.
Natural-Language Policy Violations
Medium
- Confidence
- 96% confidence
- Finding
- This file contains the skill name, usage text, error messages, and operational notes entirely in Chinese. Under the policy, forcing a specific language without offering a language or locale choice is a natural-language policy violation.
Intent-Code Divergence
Low
- Confidence
- 81% confidence
- Finding
- The comment says non-JSON input can be treated as plain-text material such as a directly pasted '合同全文', which broadens the documented input intent beyond the stated skill purpose of checking a milestone acceptance/payment checklist. This is not reflected in the manifest, which is narrowly about checklist/table verification rather than general contract-text handling.
Static analysis
No suspicious patterns detected.