Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看内置样例（一张干净的表）
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
试算平衡与期末结转核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
This skill appears to be a local trial-balance checker with no implemented network, persistence, or privileged behavior, though some help text inaccurately mentions anonymous usage statistics.
Install only if you want a Chinese-style trial-balance/account-balance checker and are comfortable running a local Node script over the table data you provide. The package appears local-only in code, but its help text should be cleaned up because it mentions anonymous usage statistics and --no-stats even though those are not implemented.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)
Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看内置样例（一张干净的表）
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看内置样例（一张干净的表）
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Natural-Language Policy Violations
Medium
- Confidence
- 91% confidence
- Finding
- The English description states this is "for a Chinese-style trial balance sheet," which constrains the skill to a specific locale/accounting format. The file does not offer a user language or locale choice, nor does it clearly frame the locale restriction as an explicit opt-in requirement in policy terms.
Natural-Language Policy Violations
Medium
- Confidence
- 92% confidence
- Finding
- The file’s user-facing natural-language documentation, sample data, labels, messages, and advice are entirely in Chinese, and the accepted headers are also hard-coded to Chinese accounting terms. There is no indication that the skill offers a language choice or that the locale restriction is explicitly documented as a justified region-specific constraint.
Natural-Language Policy Violations
Medium
- Confidence
- 94% confidence
- Finding
- Natural-language strings throughout the file, including the header comment, usage text, errors, and status output, are exclusively in Chinese. That creates a language-policy concern because the skill does not offer an alternative language or indicate that it is intentionally limited to a Chinese-speaking or region-specific audience.
Description-Behavior Mismatch
Medium
- Confidence
- 94% confidence
- Finding
- The module-level documentation and user-facing text repeatedly state that the skill will contact a server once for anonymous usage statistics after finishing. In this file, there is no import or call implementing any network/statistics logic; execution ends after local processing and printing, so the described runtime behavior does not match the actual code in this file.
Natural-Language Policy Violations
Medium
- Confidence
- 94% confidence
- Finding
- The file contains only Chinese-language field content and sample data, with no indication that the skill offers a language choice or that the locale restriction is intentional and documented. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Intent-Code Divergence
Low
- Confidence
- 97% confidence
- Finding
- The comment for loadInput says invalid JSON is treated as plain-text material such as a '合同全文' (full contract text), which is unrelated to the stated accounting trial-balance checking purpose. The rest of the file consistently describes trial-balance/general-ledger input, so this comment appears to be copied from a different skill and actively misstates the intended input semantics.
Static analysis
No suspicious patterns detected.