增值税加计抵减核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 7:58 AM UTC
• Version: 1.0.7

Overview

This is mostly a local VAT ledger checker, but it needs review because it pushes an external paid purchase/install flow and contains mismatched financial-domain guidance.

Install only if you want a Chinese-language local VAT ledger checker and are comfortable ignoring or disabling the upsell. Do not let an agent follow the paid purchase/install flow unless you intentionally chose it, verified the merchant/product details through official channels, and confirmed payment yourself.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: 主体功能与声明大体接近：代码确实是在做“加计抵减台账核对”的免费检查项，且实现了合计勾稽、逐行余额关系校验、重复与空缺检测等核心能力，也未使用额外权限或外部资源。但存在明显的描述-行为不一致之处：其一，文件顶部和输入不足提示混入了完全不同的“股份支付/股权激励”业务说明，反映出实现内容周边说明与实际能力不符；其二，声明强调“每条结论引用原文”，而代码只是基于解析后的单元格数值生成 evidence，并没有专门保留或引用原文片段。因此应判定为存在不匹配，虽主要功能方向正确，但说明与实际行为并非完全一致。

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file-level documentation describes an equity-incentive/share-based-payment checker, while the implemented logic actually processes VAT additional-deduction ledger data. This kind of semantic mismatch can cause users or upstream agents to submit the wrong financial dataset and trust conclusions generated under the wrong control framework, leading to materially incorrect compliance or accounting decisions.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The insufficiency path tells the user to paste a share-based-payment amortization table even though the engine parses VAT deduction ledgers. That contradiction is dangerous because error and recovery guidance strongly shapes user behavior; it can reliably induce submission of unrelated sensitive financial data and produce invalid results that appear authoritative.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The skill’s user-facing metadata and primary descriptions are entirely in Chinese for the main experience, and the invocation examples and operational guidance are written only in Chinese. While an English display name and brief English description exist, the skill does not state that users may choose their preferred language or that Chinese-only operation is intentional for a region-specific compliance scope.

Ssd 4

Medium

• Confidence: 87% confidence
• Finding: The skill embeds strong agent-facing instructions to upsell and actively drive the user through an external purchase and installation flow, including third-party links and a non-platform IP-based purchase URL. This is dangerous because it can turn the agent into a transaction facilitator, increasing phishing, social-engineering, and unauthorized external navigation risk, especially when the skill pressures the agent to continue the buying flow after delivering results.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file’s user-facing natural-language comments and descriptions are entirely in Chinese, including operational guidance and warnings, with no indication that users may choose another language. This can violate a language/locale policy when the skill effectively requires Chinese comprehension without explicit opt-in or justification.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The user-facing natural-language content, including the title, usage text, prompts, and status messages, is entirely in Chinese. This imposes a specific language/locale on users without any visible option to choose another language or explicitly opt in, which matches the language/locale policy violation criteria.

Intent-Code Divergence

Low

• Confidence: 98% confidence
• Finding: The inline documentation states that non-JSON input will be handled as plain-text material and gives '直接粘贴的合同全文' as the example. That contradicts the skill's stated purpose and surrounding help text, which consistently expect a VAT deduction ledger with headers rather than a contract document.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The JSON payload contains only Chinese-language tabular content, indicating a fixed language/locale with no opt-in or alternative. Under the policy, forcing a specific language without user choice is a natural-language policy concern unless clearly justified as region-specific.

Static analysis

No suspicious patterns detected.