分包结算与产值核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 7:47 AM UTC
• Version: 1.0.44

Overview

The free checker itself runs locally, but the skill also instructs the agent to route users into an external paid purchase and installation flow that conflicts with its local/no-payment framing.

Install only if you are comfortable with a Chinese-language local settlement-table checker that also promotes a paid upgrade. Treat the bundled checker as local-only, but do not allow the agent to follow external SkillPay links, install onboarding skills, or generate payment links unless you deliberately want that purchase flow and have verified the merchant, product, amount, and platform payment rules yourself.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The skill claims it runs fully locally and does not use the network, yet later instructs the agent to access external URLs for purchase, installation guidance, and payment. This contradiction is dangerous because it misrepresents the trust model to users and reviewers, potentially causing them to approve networked behavior and external redirections they would otherwise reject.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is presented as a local free checking tool, but its instructions direct the agent to upsell, initiate purchase/install flows, and provide payment links or QR codes for a separate paid product. This creates an unjustified commerce capability inside a non-commerce skill and can steer an agent into handling transactional flows, external links, and installation of additional software outside the user’s original intent.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The documented purpose is to verify subcontract settlement tables, but the content adds sales and order-routing behavior unrelated to that purpose. This unnecessary expansion of scope increases phishing, social-engineering, and unauthorized workflow risks by conditioning the agent to drive users toward off-task purchases and external transaction endpoints.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The operational instructions to the agent, purchase flow text, and required user-facing messaging are all written as mandatory Chinese-language content, while the file does not offer an opt-in language choice for users. Although an English display name and short description exist, the core required interaction flow appears fixed to Chinese, which is a natural-language locale policy concern absent explicit user choice or justification.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file’s natural-language comments, labels, messages, and user-facing guidance are entirely in Chinese, and there is no indication that the skill supports other languages or that use of Chinese is optional. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless clearly justified as region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The user-facing title, help text, usage guidance, error messages, and operational notes are all presented exclusively in Chinese. This imposes a specific language on users without any opt-in or documented locale limitation, which matches the language/locale policy violation criteria.

Vague Triggers

Low

• Confidence: 86% confidence
• Finding: The description says the trigger words include “分包结算与产值核对” and “分包结算与产值核对表对不上”, but it does not clarify whether these are the only triggers, what nearby contexts should not activate the skill, or any negative examples. This leaves activation scope underspecified in a manifest/markdown file, which can cause unintended invocation in broader accounting conversations.

Intent-Code Divergence

Low

• Confidence: 89% confidence
• Finding: The inline comment states that non-JSON input is treated as plain text such as '直接粘贴的合同全文', which contradicts the rest of the file's stated intent that input should be a 分包结算与产值核对表 with headers. The code itself does pass arbitrary plain text through to the engine, but the documented example broadens the intended material type beyond the skill's declared purpose.

Static analysis

No suspicious patterns detected.