印花税计税依据核对（免费版）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:16 AM UTC
• Version: 1.0.7

Overview

The local tax-checking code appears purpose-aligned, but the skill also steers users into an unpinned external installer, a paid purchase flow, and instructions from an unaudited newly installed skill.

Use the free checker only if you are comfortable with a local Chinese stamp-duty ledger tool. Do not paste the bundled paid-upgrade prompt into an agent unless you separately trust the payment installer, verify the exact package/version and merchant/product identifiers, and are prepared for additional skills or dependencies to be installed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:73
• Finding: Unpinned Third-Party Package Execution and Mutable Onboarding Chain<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:73-78` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Evidence The following is an English translation of the complete relevant instruction block; package names, commands, URLs, merchant identifiers, and product identifiers are preserved exactly: ```text Purchase and install the Skill "Stamp Duty Base Check — Perpetual Edition" through SkillPay. Official installation and purchase instructions: https://skillpay.alipay.com/buildguide.md First read the official instructions, verify the source, and complete the first step in the guide: npx -y @alipay/agent-payment@latest install After installation, read SKILL.md from the newly installed skillpay-onboarding Skill, and follow its instructions to purchase and install product S0806000206851210 from merchant 2088702818190040. I authorize dependency installation and initiation of the purchase. When wallet authorization or payment is required, provide the official link or QR code for my personal confirmation; do not confirm on my behalf. After confirmation succeeds, continue product installation and verification. ``` ### Technical Analysis The instruction executes `@alipay/agent-payment@latest` through `npx -y`. The `latest` tag is mutable and does not identify a reproducible, previously audited package version. The `-y` option suppresses the normal installation confirmation, reducing the opportunity for the user to inspect the resolved package and version. No lockfile, exact version, package integrity hash, signature requirement, or vendored dependency is provided. Consequently, code executed at installation time can differ from the code that existed when this Skill was audited. The workflow then directs the Agent to read and follow `SKILL.md` from a newly installed `skillpay-onboarding` Skill. That file is not included in this project and was therefore outside the audit scope. The effective workflow is consequently cont ...[truncated 2180 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed package version: ```bash npx --yes @alipay/agent-payment@X.Y.Z install ``` 2. Verify the downloaded package using an approved integrity hash, signature, or trusted package-lock mechanism before execution. 3. Avoid directly executing remote packages through `npx`; vendor the reviewed installer in the Skill package where practical. 4. Do not suppress meaningful user review. Present the resolved package name, exact version, publisher, source registry, and integrity value before execution. 5. Pin and audit all transitive dependencies. 6. Include the onboarding instructions in the reviewed package instead of delegating control to a newly downloaded `SKILL.md`. 7. Require a separate explicit user decision after installation and before reading or acting on external Skill instructions. 8. Document the external package and onboarding Skill as separate trust boundaries rather than implying that they are part of the audited local checker. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:70
• Finding: Agent Workflow Redirected to Instructions from an Externally Installed Skill<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:70-79` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Evidence The following is an English translation of the complete relevant instruction block; executable commands and identifiers are unchanged: ```text Send the following passage unchanged to your AI assistant, and it can guide you through installation and purchase: Purchase and install the Skill "Stamp Duty Base Check — Perpetual Edition" through SkillPay. Official installation and purchase instructions: https://skillpay.alipay.com/buildguide.md First read the official instructions, verify the source, and complete the first step in the guide: npx -y @alipay/agent-payment@latest install After installation, read SKILL.md from the newly installed skillpay-onboarding Skill, and follow its instructions to purchase and install product S0806000206851210 from merchant 2088702818190040. I authorize dependency installation and initiation of the purchase. When wallet authorization or payment is required, provide the official link or QR code for my personal confirmation; do not confirm on my behalf. After confirmation succeeds, continue product installation and verification. ``` ### Technical Analysis The project embeds a ready-made Agent prompt that changes the Agent's task from local stamp-duty checking to software installation, interpretation of an external Skill, purchase initiation, and post-payment installation. The most significant instruction is to read the newly installed `skillpay-onboarding/SKILL.md` and then follow its instructions. Because that Skill is not part of this repository, its contents cannot be validated by this audit. The local Skill therefore establishes a delegation point at which externally controlled instructions can redefine subsequent Agent actions. This differs from a conventional informational hyperlink: the user is instructed to forward operational directives unchanged, and the ...[truncated 1810 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove instructions telling the Agent to automatically follow a newly installed Skill's `SKILL.md`. 2. Treat installation, review, purchase initiation, payment confirmation, and product installation as distinct user-approved stages. 3. After installation, require the Agent to summarize the external Skill's requested permissions and actions without executing them. 4. Require explicit user authorization for each command, installation, external navigation, or purchase initiation. 5. Define a narrow action allowlist and prohibit the onboarding component from changing unrelated safety rules or accessing unrelated data. 6. Bundle a reviewed, immutable onboarding procedure with the project where possible. 7. Clearly state that external guides and Skills are outside this project's trust and audit boundary. 8. Validate merchant and product identifiers through an independently trusted channel before displaying payment links or QR codes. ]]>

other

Note

• Location: scripts/run.mjs:196
• Finding: Commercial Promotion Automatically Injected into Successful Human-Readable Results<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.mjs:196-199` **Vulnerability Type**: `other: Commercial Output Injection` **Risk Level**: Low ### Evidence The following is an English-translated rendering of the complete affected code block. The URL and product identifier are preserved: ```js console.log(''); // __UPSELL__ console.log('For the full edition: Stamp Duty Base Check — Perpetual Edition (SkillPay product ID S0806000206851210). The five checks not executed by this version are included in the full edition.'); console.log('Public entry point and official purchase command: https://chenqg618.github.io/compliance-skills/buy.html (you may also review the optional full-edition section in this package\'s SKILL.md).'); console.log(JSON.stringify(view.result, null, 2)); ``` ### Technical Analysis Every successful non-JSON execution appends a fixed commercial promotion and external purchase URL before printing the functional result. The behavior is unconditional within the successful human-readable output path and is not controlled by an explicit option such as `--show-upgrade`. This is not evidence of code execution, credential theft, or data exfiltration. However, it modifies normal task output with unrelated commercial content. In Agent-mediated environments, generated output may be relayed to users, stored in reports, or interpreted as an action recommendation. Automatic inclusion therefore increases the chance that a downstream Agent or user follows the external purchase workflow without separately requesting it. The JSON output path does not include these promotional lines, which limits the scope of the issue to the default human-readable mode. ### Attack Path 1. A user runs a normal local ledger check without requesting purchase information. 2. The check completes successfully in default human-readable mode. 3. The CLI automatically adds the paid-product message and external URL. 4. A downstream Agent, report processor, or user ...[truncated 812 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove promotional content from the default functional result path. 2. Place upgrade information behind an explicit option such as: ```bash node scripts/run.mjs --show-upgrade ``` 3. Print the accounting result before any optional informational material. 4. Clearly label external purchase information as optional and unrelated to the successful completion of the free checks. 5. Keep machine-readable and human-readable outputs free from external links unless the user explicitly requests them. 6. If promotion is retained, avoid operational instructions that cause an Agent to execute packages or automatically follow external Skills. ]]>

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: A supposedly local, free checking skill embeds marketing and step-by-step instructions to purchase and install a separate paid product, including authorization for dependency installation and initiating a purchase flow. This mixes analysis functionality with monetization and installation prompts, increasing the chance that an agent follows unrelated high-risk actions that expand trust boundaries from local read/bash use to remote package execution and payment workflows.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The skill instructs users to run `npx -y @alipay/agent-payment@latest install`, which fetches and executes remote code without pinning to an immutable version. This creates a supply-chain risk: if the package is updated maliciously, compromised, or publishes breaking behavior, the agent or user may execute attacker-controlled code during purchase/install flow.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This JavaScript file contains all user-facing instructions, error messages, labels, and disclaimers in Chinese, including outputs returned to callers. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the regional constraint is explicitly justified; this file does not offer language choice or clearly state that the skill is China-only.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file’s user-facing documentation and runtime messages are entirely in Chinese, presenting the skill as operating in that language by default. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless a justified locale restriction is clearly documented, which is not present here.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The JSON sample text is entirely in Chinese and provides no indication that language selection is optional or that the skill is specifically limited to a Chinese locale. This can indicate a natural-language policy violation when a skill implicitly forces a specific language without user opt-in.

Intent-Code Divergence

Low

• Confidence: 80% confidence
• Finding: The documentation emphasizes '完全本地运行', '不联网', and frames the free/paid difference as only the listed checks, yet later introduces networked purchase and installation behavior for the paid edition. This mismatch can mislead users or agents about the true trust and execution model, making them more likely to accept remote actions they would otherwise scrutinize.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The inline documentation states that non-JSON input will be handled as plain-text material such as a 'directly pasted full contract'. However, the manifest and surrounding help text consistently scope the skill to 印花税计税依据台账 input with table headers, and insufficient ledger structure should lead to no conclusion. This comment overstates accepted input in a way that can mislead about the skill's actual intended scope.

Static analysis

No suspicious patterns detected.