税收优惠适用条件自查核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 7:50 AM UTC
• Version: 1.0.34

Overview

The local checker code is contained, but the skill also pushes an external purchase and installation flow that goes beyond a free offline tax-table check.

Install only if you are comfortable with a Chinese-language local tax-table checker that includes a built-in paid-version upsell. Do not authorize purchase, link following, dependency installation, or paid-skill installation unless you intend to buy and have independently verified the merchant, product, order amount, and payment page; consider disabling the upsell with SKILL_NO_UPSELL=1 where supported.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill markets itself as a fully local, no-network free checker, yet elsewhere instructs the agent to navigate external purchase flows and surface payment links/QR codes. This creates a deceptive trust boundary: users and host agents may grant execution under the assumption of offline-only behavior, while the documentation embeds behavior that can lead to network access and commercial redirection.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The skill's stated purpose is tax-table verification, but it also directs the agent to perform commercial prompting, installation guidance, and purchase-handling steps. Embedding transactional behavior unrelated to the core function increases the chance of unauthorized persuasion, policy bypass, or expansion of the agent's operational scope beyond what the user expected.

Natural-Language Policy Violations

Medium

• Confidence: 78% confidence
• Finding: Nearly all user-facing instructions and operational guidance are provided only in Chinese, including required purchase and usage steps, while the skill does not explicitly say that Chinese is required or offer a language/locale choice. This can violate language/locale policy when a skill imposes a language without opt-in or justification.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The skill states that trigger phrases 'include' two phrases, but it does not define whether these are the only triggers, what close variants should or should not activate the skill, or any negative examples. This ambiguity can cause unintended invocation because the activation boundary is not clearly specified.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The file claims the only difference between free and paid versions is omitted checks, but it also adds mandatory upsell and purchase-handling behavior. This inconsistency is dangerous because it obscures non-functional behavior changes that affect user trust, agent permissions, and exposure to commerce-related risk.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The documentation includes multiple external URLs, redirect endpoints, and a JSON endpoint intended for AI consumption, despite the tool being framed as an offline free checker. These instructions expand the attack surface to phishing, silent redirection, stale or replaced product IDs, and unreviewed external content that the agent may be induced to trust.

Ssd 4

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to obtain authority, initiate purchase flows, install dependencies, and continue the transaction until the user payment-confirmation boundary. Even with a stated requirement that the user confirm payment, this is still a risky delegated-commerce workflow that can normalize overreach, expose users to manipulated links, and blur responsibility for transactional actions.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file’s user-facing documentation, prompts, error messages, and result strings are written exclusively in Chinese, such as the header comments and later returned advice/message text. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The file’s user-facing descriptions, usage text, errors, and outputs are entirely in Chinese, and there is no indication that another language is supported or that the user is opting into a Chinese-only experience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Intent-Code Divergence

Low

• Confidence: 95% confidence
• Finding: L077 的注释写明“不是 JSON 就当作纯文本材料（例如直接粘贴的合同全文）”，这与文件头、帮助文本和 manifest 中反复强调的“税收优惠适用条件自查表（含表头）”输入范围不一致。代码实际确实会把任意非 JSON 文件内容作为 text 载入，因此该注释在意图层面扩张了适用对象，和技能声明的专用用途相冲突。

Static analysis

No suspicious patterns detected.