Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
进项税额转出核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
The local tax checker itself is contained, but the skill also tells the agent to route users through a paid external purchase and installation flow despite advertising no payment and no network use.
Install only if you are comfortable with a Chinese-language local VAT checker that also contains agent-readable upsell instructions. Do not let an agent fetch dynamic purchase instructions, install SkillPay/onboarding components, or initiate any paid flow unless you explicitly intend to buy the paid edition and verify the merchant, product, amount, and platform rules yourself.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)
Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Description-Behavior Mismatch
High
- Confidence
- 95% confidence
- Finding
- The skill markets itself as fully local and offline, but embeds mandatory paid-flow instructions that require network access, external purchase handling, and post-purchase installation steps. This creates a trust-boundary mismatch: users and agents may rely on the "no network" claim while the skill later attempts to drive external actions involving commerce and installation.
Context-Inappropriate Capability
High
- Confidence
- 93% confidence
- Finding
- The skill instructs the agent to handle payment-link delivery, purchasing, and installation behavior unrelated to VAT verification. Expanding a business-ops checking skill into transaction-orchestration increases attack surface for phishing, policy bypass, and unauthorized commercial actions, especially because the agent is told to "really complete" the purchase flow.
Natural-Language Policy Violations
Medium
- Confidence
- 87% confidence
- Finding
- The skill’s user-facing name, summary, and primary descriptions are presented in Chinese, and the operational instructions throughout the document are written for Chinese-language use. Although there is an English display name and brief English description, the file does not offer users an explicit language choice or opt-in for locale, which can violate a language/locale policy if the skill is not clearly restricted to a Chinese-only audience.
Whitespace Padding
Medium
- Category
- Prompt Injection
- Content
输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。 执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致； ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。
- Confidence
- 80% confidence
- Finding
- Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Intent-Code Divergence
Medium
- Confidence
- 88% confidence
- Finding
- The documentation claims the only difference between free and full versions is the listed check coverage, but the free skill also imposes mandatory upsell and purchase-handling behavior. This is a deceptive capability description that can mislead both users and safety systems about what the skill actually causes the agent to do.
Context-Inappropriate Capability
Medium
- Confidence
- 96% confidence
- Finding
- The skill directs the agent to fetch or follow external URLs, including a dynamic JSON endpoint and a redirecting purchase URL, despite presenting itself as local-only. Dynamic external endpoints can change over time and may expose the agent or user to malicious content, phishing, or unreviewed instructions outside the audited skill package.
Natural-Language Policy Violations
Medium
- Confidence
- 94% confidence
- Finding
- The file-level documentation and user-facing guidance are entirely in Chinese, including operational warnings and usage instructions. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly justified or the user is given a choice.
Natural-Language Policy Violations
Medium
- Confidence
- 91% confidence
- Finding
- The returned advice text is user-facing natural language and is hardcoded in Chinese. The file does not indicate that language selection is configurable or that Chinese is required for a documented region-specific compliance context.
Natural-Language Policy Violations
Medium
- Confidence
- 90% confidence
- Finding
- The main execution path returns multiple user-visible messages, notes, and disclaimers exclusively in Chinese. Because no alternative locale or opt-in is provided in the file, this appears to enforce a specific language by default.
Intent-Code Divergence
Low
- Confidence
- 90% confidence
- Finding
- The comment documents non-JSON fallback as handling '直接粘贴的合同全文', but the rest of the file consistently describes the input as a 进项税额转出计算表 with headers. This is an active documentation mismatch that broadens the apparent intent beyond the actual declared skill purpose.
Static analysis
No suspicious patterns detected.