差旅与通行费技能包（免费版）

• Outcome: Pass
• Latest audit: Sep 20, 2026 · 3:32 PM UTC
• Version: 1.0.22

Overview

This is a local travel and toll expense checker that reads user-provided files and prints results without network use, file writes, persistence, or hidden high-impact behavior.

Before installing, understand that this tool processes reimbursement worksheets you point it at, so only run it on intended local folders. Treat its output as a local arithmetic/consistency aid, not an audit, tax, approval, or policy decision; review the runtime not-run sub-check list for coverage gaps.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: 描述把该技能表述为一个面向整套差旅材料、按部门逐一给出结论的免费版工具，并明确免费版包含两项检查，其中之一是差旅费标准与超标核对。该代码块却只是通行费检查引擎的一部分，且专注于通行费表与车辆台账的表内/表间勾稽，不处理差旅费标准、报销超标判断或部门维度汇总。虽然代码确实“不付款、不注册”，也与声明中的“通行费与过路过桥核对”部分相符，但其主能力范围明显更窄且行为形式不同：它不是完整的“2项免费版”技能实现，而是其中一个子检查模块，并且该模块内部实际做了 6 项通行相关检查。因此，声明对整体功能与输出形态的表述不能准确代表这段代码的实际行为，构成实质性不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: 核心能力存在实质不一致。声明把免费版范围限定为 2 项，其中一项是“通行费与过路过桥核对”，但代码完全没有围绕通行费/过路过桥票据的专门逻辑；其“交通费”只是差旅报销字段的一部分，与声明的通行费核对不是一回事。相反，代码实现了 6 项检查，并且其中 4 项（合计行复核、重复检测、空白占位符、负数检测）并未在声明中体现，导致实际能力超出且偏离声明范围。输出形态也不一致：声明说“逐部门核一遍，每个部门一行结论”，代码则解析单张文本表，对每条明细/合计行产生 findings，未体现部门聚合。虽然“不付款、不注册、无网络”与代码基本一致，但主要用途和免费版包含的检查项与声明不符，应判定为 mismatch。

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单部门样例（内置，2 项全跑）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单部门样例（内置，2 项全跑）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单部门样例（内置，2 项全跑）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单部门样例（内置，2 项全跑）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill description promises both travel-standard verification and toll/road-bridge fee verification, but this module only implements travel expense consistency checks. In this skill context, missing the toll-verification capability is dangerous because users may trust a partial review as complete and miss reimbursement or compliance errors in toll-related records.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The code explicitly defines and reports 6 free checks, while the skill metadata states the free version should perform only 2 checks. This is a real integrity and policy-enforcement issue because it breaks the declared product boundary and can mislead users, downstream agents, or billing/entitlement logic that rely on the manifest.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The main user-facing instructions from L019 onward are presented almost entirely in Chinese, while the file does not state that the skill is region-specific or require user opt-in for that language. Under the stated policy, forcing a specific language without choice can be a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file’s natural-language instructions, messages, and disclaimers are written exclusively in Chinese, and the runtime returns Chinese-only user-facing strings throughout the skill. Under the stated policy, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is clearly documented and justified as region-specific.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The comments and docstring contain conflicting statements about what the free tier includes, creating an internal documentation mismatch. While not a code-execution flaw, it is a real security/trust issue because contradictory scope statements can cause operators and dependent systems to overtrust the completeness of results.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The file’s natural-language documentation and all user-facing strings are entirely in Chinese, including required input guidance and result messages. There is no indication that the skill is region-specific or that users can opt into another language, which can violate a language/locale policy requiring user choice or explicit justification.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The header documentation explicitly states that `CHECKS_WITHHELD` is only explanatory text and that the free package implements only the free checks. Later in the file, the code invokes `ledger_hook` and conditionally marks withheld capabilities as executed, which directly contradicts the claim that those withheld checks are not implemented in this package.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest says the free version only performs two checks and does not execute the four additional determinations such as cross-department summary ledgers. However, this file's runtime still calls `ledger_hook(...)` and, if it returns true, upgrades the result to mark the withheld paid capabilities as executed, meaning the shared source contains behavior beyond the free manifest's stated scope.

Intent-Code Divergence

Low

• Confidence: 48% confidence
• Finding: The header documents the file as a self-contained checking tool with a narrow contract, centered on local analysis via the main entrypoint. However, the module also exports parsing and normalization helpers (`parseTable`, `roleOf`, `normNumber`, `round2`, `parseStamp`, `parsePeriod`) for external reuse, which broadens the exposed behavior beyond the documented tool-focused contract. This is a mild documentation/intent mismatch rather than a security-sensitive contradiction.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: This JSON template contains user-facing natural-language content only in Chinese, which can constitute a language/locale policy violation when no opt-in or alternative language choice is provided. The rule applies to all file types, including JSON, and the text does not document any justified region-specific constraint.

Static analysis

No suspicious patterns detected.