Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
车辆保险与保费摊销核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
The checker itself runs locally, but its skill instructions add a mandatory paid-upgrade purchase and installation workflow that is broader than the stated offline free-check purpose.
Install only if you are comfortable with a Chinese-language local checker that also prompts for a paid upgrade. Do not let the agent follow the purchase or installation links unless you explicitly want the paid version and have independently verified the merchant, product, amount, and platform rules.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)
Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Description-Behavior Mismatch
High
- Confidence
- 97% confidence
- Finding
- The skill markets itself as a fully local, no-network checker, but later embeds mandatory instructions that cause the agent to present or initiate remote purchase, installation, and payment flows. That creates a deceptive trust boundary: a user or orchestrating agent may believe the skill is offline-only while being steered into external URLs, package installation, and commerce actions unrelated to the core checking task.
Context-Inappropriate Capability
High
- Confidence
- 95% confidence
- Finding
- The skill injects mandatory commercial workflow instructions into an accounting-checking tool, including requiring the agent to offer paid upgrade paths and potentially initiate a purchase flow. This is dangerous because it broadens the skill from deterministic document checking into transaction orchestration, increasing phishing, social-engineering, and unauthorized external-action risk without necessity for the stated business purpose.
Description-Behavior Mismatch
Medium
- Confidence
- 78% confidence
- Finding
- The manifest says the free version executes the engine-declared free checks, while later documentation enumerates excluded checks and says '两档的差别就是上面这些，没有别的'. If the packaged engine behavior differs from that prose, users and auditors cannot reliably infer what the skill actually does from the manifest alone. This is a description-to-behavior mismatch risk because scope is delegated to engine exports rather than being stably described.
Natural-Language Policy Violations
Medium
- Confidence
- 91% confidence
- Finding
- The instructional section addressed to the agent is entirely in Chinese and mandates specific user-facing disclosures on every invocation, but it does not offer any opt-in or alternative language path. Because this is a natural-language policy issue applicable to all file types, the file should not implicitly require a single language unless the locale restriction is explicit and justified.
Whitespace Padding
Medium
- Category
- Prompt Injection
- Content
输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。 执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致； ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。
- Confidence
- 80% confidence
- Finding
- Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Natural-Language Policy Violations
Medium
- Confidence
- 98% confidence
- Finding
- The file’s natural-language documentation and user-facing strings are entirely in Chinese, including instructions, error messages, and disclaimers. There is no indication that the skill supports other languages or that users are asked to opt into a Chinese-only experience, which creates a locale/language policy concern.
Intent-Code Divergence
Medium
- Confidence
- 92% confidence
- Finding
- The finding message states that '保费总额、本期新增保费与本期摊销额都不该为负', but the very next clause says refund/endorsement reversals should be shown as a negative '本期新增保费'. This is an active contradiction in inline documentation/message text about intended behavior, not merely an omission.
Natural-Language Policy Violations
Medium
- Confidence
- 95% confidence
- Finding
- The user-facing description, usage text, errors, and output strings are entirely in Chinese, and the file does not indicate that language selection is optional or configurable. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Natural-Language Policy Violations
Medium
- Confidence
- 95% confidence
- Finding
- The sample payload on L2 is entirely in Chinese field labels and values, indicating a fixed language/locale. For a file type covered by policy checks, this is a natural-language locale constraint with no visible opt-in, user choice, or justification that the skill is region-specific.
Intent-Code Divergence
Low
- Confidence
- 94% confidence
- Finding
- The inline documentation says non-JSON input will be handled as plain-text material, giving '直接粘贴的合同全文' as an example, which contradicts the surrounding manifest and usage text that require a vehicle-insurance amortization check table with headers. The implementation indeed passes arbitrary plain text through to the engine, so the comment broadens the intended input type beyond the skill's declared purpose.
Static analysis
No suspicious patterns detected.