Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看样例（一张算得平的干净表，用来确认格式）
Security audit
仓储费与库龄结算核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
This skill locally checks user-provided warehouse fee tables and does not show hidden network use, persistence, credential access, or data mutation.
This appears safe to install for local review of warehouse fee tables. Users should still avoid treating its financial findings as final payment instructions, and should be aware that the interface and sample data are Chinese-language and that a few descriptions of free versus withheld checks should be clarified by the publisher.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看样例（一张算得平的干净表，用来确认格式）
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看样例（一张算得平的干净表，用来确认格式）
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file’s natural-language instructions, descriptions, and user-facing messages are entirely in Chinese, and there is no indication that the user can opt into another language or locale. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest says the free version executes 6 free checks, but the code documentation explicitly states '免费档执行 8 项' and the runtime actually performs eight categories of checks via row recomputation, billed-days validation, over-fee validation, payable-sum validation, negatives, integer-day checks, total-row amount checks, duplicates, and blanks. This is a semantic mismatch about the skill's scope and behavior, not a mere implementation detail.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The JSON payload consists entirely of Chinese headers and values, indicating a fixed language/locale output. Because this file provides no opt-in, language selection, or documented region-specific justification, it can violate the policy against forcing a specific language without user choice.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Lines L002-L003 say the file only implements the free-tier subset and that withheld checks are descriptive text only, but the next main module docblock labels the file as '完整档 / 买断版'. That inline documentation is internally contradictory about what this file actually is, which can mislead auditors or downstream maintainers about the implemented scope.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The disclaimer says the tool only checks '表内可复算' relationships, then adds that the overcharge baseline uses the same-table average unit price for the same material. This file does not implement any average-price overcharge baseline analysis, so the output text describes behavior that this module does not perform.
- Content