Security audit

三单匹配AI核对（免费版）

Security checks for vulnerabilities and agentic risk

Overview

This is a local three-way matching helper for purchase documents; it does not show network use, persistence, credential access, or hidden behavior, but users should treat its checks as limited.

Before installing, confirm that users understand this is a local helper for limited document comparison, not a complete approval, fraud, invoice-authenticity, tax, tolerance, or payment-decision system. It appears safe from a security-permission perspective, but finance teams should not rely on it as the only control before payment.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill advertises specific three-way matching capabilities and implies reliable checks on quantity, unit price, and amount consistency, but the documented analysis indicates the implementation only performs a narrower generic mismatch check and omits several described validations. In a finance workflow, this can create false assurance: users may rely on the tool to catch payable discrepancies or duplicate-payment risks that it does not actually detect, leading to missed control failures.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
md
node scripts/run.mjs --sample

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
md
node scripts/run.mjs --sample

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.
md
node scripts/run.mjs --sample

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description lists trigger phrases such as “订单号对不上”, “供应商名称不一致”, and “重复付款”, which are generic problem statements rather than narrowly scoped invocation commands. In a broad assistant environment, these phrases could match everyday AP discussions and cause unintended activation because the boundaries of when this skill should or should not trigger are not clearly constrained.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file’s natural-language documentation and operational guidance are entirely written in Chinese, and the sample/output conventions also assume Chinese-language interaction. There is no indication that users may choose another language or locale, which can violate a language-choice policy when the skill is not explicitly region-specific.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest promises that every conclusion includes original line numbers. In checkCrossDocument, findings are created with line value 0 even though the message embeds per-document line references; this does not satisfy the stated line-numbered conclusion behavior in the structured output itself. That is a mismatch between claimed output semantics and actual implementation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The header comment explicitly states that with insufficient material it returns insufficient_input and '绝不输出"未发现问题"'. However, the success verdict path returns '在上述检查项范围内没有发现问题 —— 这不等于没有问题' when no findings are produced. This is an active contradiction between documented intent and actual behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file’s user-facing description, usage text, errors, and output strings are entirely in Chinese, indicating the skill is intended to operate in a single language. There is no natural-language indication that users may choose another language or that the Chinese-only behavior is a justified region-specific requirement.
Content: No source excerpt is available for this finding.