Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
加工贸易手册与保税料件核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
The local checker appears offline, but the skill mixes in mandatory external purchase and install instructions that conflict with its no-payment and no-network claims.
Install only if you want a Chinese-language local checker and are comfortable ignoring or disabling the upsell. Do not let an agent follow the paid upgrade, external buildguide, dependency install, or SkillPay purchase flow unless you independently trust those URLs, merchant details, package names, and platform payment rules.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Context-Inappropriate Capability
High
- Confidence
- 96% confidence
- Finding
- The skill’s stated purpose is deterministic reconciliation of customs/toll-processing tables, but it embeds e-commerce and payment-handling instructions unrelated to that core function. Mixing operational analysis with monetization and installation flows increases the chance of social engineering, coerced upsell behavior, and user confusion about what actions are necessary to complete the task.
Description-Behavior Mismatch
High
- Confidence
- 98% confidence
- Finding
- The skill advertises itself as a fully local, no-network checker, but embedded instructions direct the agent to access external purchase/install URLs and carry out a payment-related flow. This creates a deceptive trust boundary: an agent or user may believe the skill is offline and low-risk while it actually attempts remote interactions that could expose users to phishing, unauthorized commerce, or unreviewed dependency installation.
Intent-Code Divergence
Medium
- Confidence
- 98% confidence
- Finding
- The documentation explicitly claims '完全本地运行' and '不联网', yet later sections instruct the agent to use remote web resources and purchase endpoints. This inconsistency is security-relevant because users and host systems may grant trust or permissions based on the offline claim, making subsequent network-directed behavior deceptive and potentially unsafe.
Natural-Language Policy Violations
Medium
- Confidence
- 89% confidence
- Finding
- The file contains mandatory agent instructions telling the agent exactly what it "must" tell users, and the surrounding prescribed messaging is written only in Chinese. There is no opt-in or alternative language path in these operational instructions, despite the skill metadata being bilingual, which creates a locale/language policy concern for users who may not want Chinese-only interaction.
Whitespace Padding
Medium
- Category
- Prompt Injection
- Content
输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。 执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致； ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。
- Confidence
- 80% confidence
- Finding
- Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Natural-Language Policy Violations
Medium
- Confidence
- 95% confidence
- Finding
- The file’s user-facing natural-language documentation, warnings, and output strings are written entirely in Chinese, and there is no indication that the user can opt into another language. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is explicitly justified.
Natural-Language Policy Violations
Medium
- Confidence
- 87% confidence
- Finding
- The file’s user-facing description, usage text, errors, and output strings are entirely in Chinese, with no indication that another language is supported or that the locale restriction is optional. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is explicitly documented and justified as region-specific.
Static analysis
No suspicious patterns detected.