税务风险指标自查核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 7:50 AM UTC
• Version: 1.0.35

Overview

The bundled checker is local and simple, but the skill also pushes a paid external purchase and installation flow that conflicts with its no-payment/no-network positioning.

Install only if you are comfortable with a free local checker that also instructs the agent to offer and potentially start an external paid upgrade/install flow. Do not authorize payment, wallet actions, dependency installation, or new skill installation unless you have independently verified the vendor, product, merchant number, amount, and platform rules.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The document explicitly states the skill is 'completely local' and 'no network', yet later instructs the agent to visit external pages and process purchase-related flows. This contradiction is dangerous because it can mislead users and security controls into trusting a skill as offline-only while it socially engineers a transition to network and payment activity.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The description says "触发词包括" and lists only two phrases, without clarifying whether the list is exhaustive or providing exclusions. One phrase, "税务风险指标自查表对不上", is relatively natural conversational wording for a discrepancy and could be invoked in contexts beyond intentional skill use.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill claims to be a free local checking tool, but embeds instructions for external purchase, installation, and payment flows. This creates a capability and trust-boundary expansion: an agent invoked for offline tax-form checking could steer users into network access and commerce actions that are unrelated to the core task, increasing phishing, social-engineering, and unauthorized transaction risk.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The operational instructions to the agent are written as mandatory user-facing behavior, but they do not offer users a language or locale option. Because the skill includes English metadata elsewhere, the absence of opt-in or documented Chinese-only restriction creates a language policy concern.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The embedded e-commerce guidance is not necessary for validating tax risk indicator forms and pressures the agent to perform actions outside the stated business purpose. When a skill includes unnecessary payment and installation steps, it increases the chance of deceptive upsell behavior or abuse of user trust under the guise of a routine document-checking workflow.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file’s user-facing natural-language instructions, labels, prompts, and disclaimer are entirely in Chinese, including required input guidance and output messages. Under the stated policy, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly documented and justified, which this file does not do.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: L364-L366 的 disclaimer 明确表示结果包含“按参考税率推算的偏离提示”，对应代码中还定义了 OUTPUT_RATE_REF、INPUT_RATE_REF、RATE_DRIFT_REF 等参考参数。但实际 run() 仅调用税负率复算、进销项比复算、负数检测、合计行复核、重复检测和空白检测，且 L318-L319 明确把相关参考口径检查列入 checks_not_run，因此文档表述与实际执行相矛盾。

Intent-Code Divergence

Low

• Confidence: 91% confidence
• Finding: The inline documentation says non-JSON input will be handled as plain-text material such as '直接粘贴的合同全文', i.e. a full contract text. However, the manifest and surrounding help text consistently state the skill is for checking a tax-risk self-inspection table with headers, not arbitrary contract documents. This is an active documentation contradiction rather than a mere omission.

Static analysis

No suspicious patterns detected.