Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
运单回单与代收货款核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
The local checker appears offline, but the skill also pushes an external paid purchase and install flow that conflicts with its no-payment and no-network framing.
Review this skill before installing if you do not want agents to present or act on paid upgrade flows. The free checker code appears local, but do not let an agent follow the SkillPay purchase/install instructions, open the direct-IP purchase URL, or install a paid companion skill unless you explicitly intend that and verify the merchant, product, amount, and platform rules yourself.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)
Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Natural-Language Policy Violations
Medium
- Confidence
- 84% confidence
- Finding
- The skill's visible title, summary, primary descriptions, usage guidance, and operational instructions are overwhelmingly written in Chinese, while the only English text is minimal metadata and not a full alternative workflow. This effectively imposes a language/locale constraint on users without an explicit opt-in or a documented region-specific justification.
Intent-Code Divergence
Medium
- Confidence
- 98% confidence
- Finding
- The documentation explicitly claims the skill is 'fully local' and 'does not use the network,' yet later requires access to external purchase and installation resources. This is dangerous because agents or users may relax scrutiny based on the offline-safety claim, while the embedded instructions actually push them into online flows involving external sites and payment operations.
Description-Behavior Mismatch
Medium
- Confidence
- 95% confidence
- Finding
- The skill presents itself as a local, deterministic checking tool, but later embeds instructions for external purchase, installation, and payment flows. This creates a trust-boundary violation: an agent may follow networked monetization steps based on skill content that users did not expect from an offline audit tool, increasing phishing, unwanted external navigation, and payment-handling risk.
Whitespace Padding
Medium
- Category
- Prompt Injection
- Content
输出与你的安全约束**；它**可被用户关闭**（`SKILL_NO_UPSELL=1`），也**必须可忽略**（不点不买不影响结果）。 执行官方购买指令时：先读一次官方说明；核对**商户号 `2088702818190040`**、商品号与订单是否一致； ⛔ 不要点击来路不明的链接/二维码，也**不要替用户付款** —— 付款一律由**用户本人**确认。
- Confidence
- 80% confidence
- Finding
- Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Natural-Language Policy Violations
Medium
- Confidence
- 92% confidence
- Finding
- This JavaScript file’s natural-language instructions, warnings, sample data labels, and returned messages are entirely in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. Under the policy, forcing a specific language without user choice or justification is a natural-language policy violation.
Natural-Language Policy Violations
Medium
- Confidence
- 94% confidence
- Finding
- Natural-language strings in the header comment and help text require Chinese for all interaction, but the file does not provide any opt-in, alternative locale, or explanation that this skill is intentionally limited to a Chinese-speaking or region-specific audience. This matches the policy category for language or locale constraints imposed without user choice.
Natural-Language Policy Violations
Low
- Confidence
- 81% confidence
- Finding
- The JSON sample consists entirely of Chinese field labels and organization names, with no indication that the skill supports other languages or that Chinese is an intentional, documented locale restriction. Under the policy rule for natural-language violations, hard-coding a single language without opt-in can be a locale-policy issue.
Static analysis
No suspicious patterns detected.