仓库周转与呆滞库存核对（免费版）

• Outcome: Review
• Latest audit: Sep 19, 2026 · 8:08 AM UTC
• Version: 1.0.41

Overview

The free checker itself is local, but its instructions push the agent into an external paid purchase and skill-install flow that is broader than the advertised no-payment, no-network purpose.

Install only if you are comfortable with the skill showing an upgrade prompt and potentially guiding an agent through an external paid SkillPay purchase and installation flow. The local free script appears limited to inventory-table checks, but the paid upgrade path should be treated as a separate trust decision; verify merchant, product, amount, and platform rules yourself, and do not let the agent approve payment on your behalf.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The documentation explicitly states 'completely local' and 'no network', but later sections require access to external URLs for buying and installing a different product. This contradiction is dangerous because it can mislead users, reviewers, and policy systems about the true trust boundary and data-exposure surface of the skill.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill advertises itself as a fully local, no-network inventory checking tool, but embedded instructions direct the agent to perform external purchase, installation, and payment-related actions. This creates a hidden capability boundary change: an agent following the skill may browse external sites, retrieve updated product identifiers, and facilitate payment flows that are unrelated to the core reconciliation task.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Payment, ordering, and installation instructions are not necessary for checking warehouse turnover data, yet the skill tells the agent to initiate acquisition and installation of another product. That unnecessary authority expansion increases the risk of deceptive upsell, external navigation, and agent-mediated transaction handling in a context where users expect only deterministic local analysis.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。
   执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致；
   ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。

• Confidence: 80% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file’s user-facing comments, instructions, field names, and messages are written entirely in Chinese, including guidance returned to users. There is no indication that the skill is region-specific or that users may opt into another language, which can violate language/locale policy requirements for skills expected to serve broader audiences.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The file's user-facing description, help text, prompts, and status messages are entirely in Chinese, which effectively imposes a specific language on users. There is no indication that the skill is region-specific, no opt-in for language selection, and no alternative locale support described.

Intent-Code Divergence

Low

• Confidence: 93% confidence
• Finding: The inline documentation says non-JSON input will be treated as plain text material such as '直接粘贴的合同全文', which conflicts with the rest of the file and manifest that narrowly describe checking warehouse inventory turnover/stagnant inventory tables. The code itself is generic plain-text input handling for this skill, so the contradiction is in the comment's stated intent rather than the implemented behavior.

Static analysis

No suspicious patterns detected.