资金与票据技能包（免费版）

• Outcome: Pass
• Latest audit: Sep 20, 2026 · 2:20 PM UTC
• Version: 1.0.27

Overview

This skill locally checks user-provided treasury and bill worksheets and I found no hidden network, write, credential, or persistence behavior.

Install only if you are comfortable running a local Node script over exported financial worksheets. Treat results as consistency checks, not audit, legal, approval, or authenticity judgments, and review the reported not-run/withheld checks before relying on the output.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (38)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding is a weaker variant of the same mismatch theme: the skill appears to act mainly as an orchestrator with structured output rather than literally one line per object, and it discloses withheld checks in the body. While still potentially misleading, this particular discrepancy is less severe than outright claiming unsupported check domains, because the documentation does mention free-version boundaries and non-executed items.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding is a weaker variant of the same mismatch theme: the skill appears to act mainly as an orchestrator with structured output rather than literally one line per object, and it discloses withheld checks in the body. While still potentially misleading, this particular discrepancy is less severe than outright claiming unsupported check domains, because the documentation does mention free-version boundaries and non-executed items.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding is a weaker variant of the same mismatch theme: the skill appears to act mainly as an orchestrator with structured output rather than literally one line per object, and it discloses withheld checks in the body. While still potentially misleading, this particular discrepancy is less severe than outright claiming unsupported check domains, because the documentation does mention free-version boundaries and non-executed items.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding is a weaker variant of the same mismatch theme: the skill appears to act mainly as an orchestrator with structured output rather than literally one line per object, and it discloses withheld checks in the body. While still potentially misleading, this particular discrepancy is less severe than outright claiming unsupported check domains, because the documentation does mention free-version boundaries and non-executed items.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding is a weaker variant of the same mismatch theme: the skill appears to act mainly as an orchestrator with structured output rather than literally one line per object, and it discloses withheld checks in the body. While still potentially misleading, this particular discrepancy is less severe than outright claiming unsupported check domains, because the documentation does mention free-version boundaries and non-executed items.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding is a weaker variant of the same mismatch theme: the skill appears to act mainly as an orchestrator with structured output rather than literally one line per object, and it discloses withheld checks in the body. While still potentially misleading, this particular discrepancy is less severe than outright claiming unsupported check domains, because the documentation does mention free-version boundaries and non-executed items.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding is a weaker variant of the same mismatch theme: the skill appears to act mainly as an orchestrator with structured output rather than literally one line per object, and it discloses withheld checks in the body. While still potentially misleading, this particular discrepancy is less severe than outright claiming unsupported check domains, because the documentation does mention free-version boundaries and non-executed items.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding is a weaker variant of the same mismatch theme: the skill appears to act mainly as an orchestrator with structured output rather than literally one line per object, and it discloses withheld checks in the body. While still potentially misleading, this particular discrepancy is less severe than outright claiming unsupported check domains, because the documentation does mention free-version boundaries and non-executed items.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding is a weaker variant of the same mismatch theme: the skill appears to act mainly as an orchestrator with structured output rather than literally one line per object, and it discloses withheld checks in the body. While still potentially misleading, this particular discrepancy is less severe than outright claiming unsupported check domains, because the documentation does mention free-version boundaries and non-executed items.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding is a weaker variant of the same mismatch theme: the skill appears to act mainly as an orchestrator with structured output rather than literally one line per object, and it discloses withheld checks in the body. While still potentially misleading, this particular discrepancy is less severe than outright claiming unsupported check domains, because the documentation does mention free-version boundaries and non-executed items.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding is a weaker variant of the same mismatch theme: the skill appears to act mainly as an orchestrator with structured output rather than literally one line per object, and it discloses withheld checks in the body. While still potentially misleading, this particular discrepancy is less severe than outright claiming unsupported check domains, because the documentation does mention free-version boundaries and non-executed items.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding is a weaker variant of the same mismatch theme: the skill appears to act mainly as an orchestrator with structured output rather than literally one line per object, and it discloses withheld checks in the body. While still potentially misleading, this particular discrepancy is less severe than outright claiming unsupported check domains, because the documentation does mention free-version boundaries and non-executed items.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding is a weaker variant of the same mismatch theme: the skill appears to act mainly as an orchestrator with structured output rather than literally one line per object, and it discloses withheld checks in the body. While still potentially misleading, this particular discrepancy is less severe than outright claiming unsupported check domains, because the documentation does mention free-version boundaries and non-executed items.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding is a weaker variant of the same mismatch theme: the skill appears to act mainly as an orchestrator with structured output rather than literally one line per object, and it discloses withheld checks in the body. While still potentially misleading, this particular discrepancy is less severe than outright claiming unsupported check domains, because the documentation does mention free-version boundaries and non-executed items.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This finding is a weaker variant of the same mismatch theme: the skill appears to act mainly as an orchestrator with structured output rather than literally one line per object, and it discloses withheld checks in the body. While still potentially misleading, this particular discrepancy is less severe than outright claiming unsupported check domains, because the documentation does mention free-version boundaries and non-executed items.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

node scripts/run.mjs --sample # 单对象样例（内置）

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

node scripts/run.mjs --sample # 单对象样例（内置）

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

node scripts/run.mjs --sample # 单对象样例（内置）

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

node scripts/run.mjs --sample # 单对象样例（内置）

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill metadata promises a broader 14-check treasury/bill verification capability, but this module explicitly implements only a narrow 9-check invoice-consistency subset. In a financial control workflow, that mismatch can cause operators or downstream agents to rely on absent checks and incorrectly treat materials as comprehensively reviewed, creating a dangerous false sense of assurance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The top-level comments and user-facing text throughout the skill are written entirely in Chinese, and returned messages such as advice, findings, notes, and disclaimers are also hard-coded in Chinese. For a general-purpose skill file, this constitutes a natural-language locale constraint without opt-in or a documented region-specific justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes a skill that checks 14 categories across treasury and bill-support documents and outputs one conclusion per object with original file and line references. This module’s own header and code show it handles only '应付账款保理与贴现核对', executes 6 checks, and expects a single pasted text table rather than reviewing the broader document set described in the manifest.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest promises that each conclusion includes the original source file and line number. In this file, findings only reference table row numbers derived from the pasted input (for example '第 X 行') and there is no handling of source filenames, original document offsets, or multi-document provenance.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The comment says the parameter is deliberately named it to satisfy an external mutation-test pattern for function checkXxx(it) {, implying a particular intent and shape. In practice, checkBlanks receives and iterates an array of rows rather than a single item, so the inline documentation is actively about gaming a test harness rather than describing the function's real behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file’s natural-language comments, user-facing advice, error text, findings, disclaimer, and sample usage are entirely written in Chinese, indicating the skill is designed to operate in a fixed language/locale. The policy requires flagging language or locale constraints when the skill does not explicitly offer user opt-in or language choice.

Content

No source excerpt is available for this finding.