连锁门店调拨与库存核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 7:45 AM UTC
• Version: 1.0.40

Overview

The local checker itself is simple and offline, but the skill also instructs agents to promote and initiate an external paid purchase and installation flow despite advertising no network or payment requirement.

Review before installing. The local script only checks provided transfer/inventory table text, but the skill instructions can steer an agent into external purchase, payment-link handling, and installation of a separate paid product. Install only if you are comfortable with that upsell behavior, and do not allow the agent to open payment or installation links unless you explicitly intend to buy the paid version.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The documentation explicitly claims 'completely local' and 'no network,' but later instructs the agent to visit external websites, fetch current product information, and follow remote purchase endpoints. This contradiction is security-relevant because users and platforms may grant the skill trust and permissions based on the offline claim, while the actual instructions attempt to induce network access and interaction with external infrastructure.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill presents itself as a local, offline, free reconciliation tool, but embeds instructions that direct the agent into external purchase and installation flows for a paid product. This creates a trust-boundary violation: a user invoking a bookkeeping skill could be unexpectedly funneled into network access, payment handling, and installation of additional software, which expands attack surface and enables phishing, unwanted commerce, or supply-chain compromise.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The embedded e-commerce and software installation guidance is unrelated to the core function of transfer/inventory reconciliation and can manipulate the agent into performing privileged side effects beyond the user's likely intent. In a skill that is supposed to analyze local documents, instructing purchase flows and dependency installation is dangerous because it mixes financial operations with content processing and can be abused for deceptive monetization or remote package delivery.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The skill's visible title, usage instructions, operational guidance, and policy text are overwhelmingly written in Chinese, while the only English content is limited metadata and a brief description. There is no explicit opt-in or alternative-language instruction path for users, which can amount to a language-policy violation if users are not given a choice.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file’s user-facing natural-language documentation and operational guidance are entirely in Chinese, with no indication that users can choose another language or locale. This can violate language/locale policy when a skill effectively constrains interaction to a specific language without explicit opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The user-facing description, help text, and console messages are all hard-coded in Chinese, which effectively forces a specific language for interaction. The file does not offer an opt-in language choice or explain that the skill is intentionally restricted to a Chinese-speaking or region-specific audience.

Intent-Code Divergence

Low

• Confidence: 91% confidence
• Finding: The inline documentation says non-JSON input is treated as plain text such as a pasted '合同全文', but the skill is described as checking store transfer and inventory reconciliation tables with headers. This is not merely incomplete wording: it explicitly documents a different document type than the skill is supposed to handle.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The JSON payload contains only Chinese headers and values, indicating a fixed language/locale choice in the skill content. For a general-purpose template file, this can violate language/locale policy when no user opt-in or justification is provided.

Static analysis

No suspicious patterns detected.