Security audit

职工福利费与教育经费限额核对（免费版）

Security checks for vulnerabilities and agentic risk

Overview

This is a local-only Chinese finance-checking skill that reads a user-provided ledger and reports deterministic validation results without network access, persistence, credential use, or data modification.

Install only if you are comfortable using a Chinese-language, local Node-based checker for this specific ledger format. Treat its output as a limited free review, not a full tax-compliance opinion, because several checks are explicitly not included.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill’s declared scope and guarantees do not cleanly match its described/observed behavior: it appears to touch related categories beyond the stated welfare/education scope, promises source-cited conclusions without clearly preserving verbatim source text, and uses broad '逐项核对/限额核对' wording while explicitly omitting checks many users would reasonably expect. In a financial compliance workflow, this can mislead users into relying on incomplete or differently-scoped results, causing false assurance, missed tax/compliance issues, or incorrect bookkeeping decisions.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
node scripts/run.mjs --sample # 先看样例

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.
md
node scripts/run.mjs --sample # 先看样例

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The user-facing skill body is entirely in Chinese and the usage guidance, warnings, and operational details are presented only in Chinese. Although there is an English display name and a brief English description in metadata, the actual operating instructions do not offer users a language choice or state that the skill is region/language-specific, which can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This JavaScript file contains all user-facing documentation, messages, and guidance exclusively in Chinese, including operational notes and result explanations. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly documented and justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file’s help text, status messages, and capability description are entirely in Chinese, and there is no indication that users may select another language or that the skill is restricted to a Chinese-only audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The comment says non-JSON input is treated as plain-text material such as '直接粘贴的合同全文', which implies broader document support. However, the rest of the script consistently requires a '职工福利费与教育经费台账（含表头）' and reports insufficient input when recognizable ledger elements are missing, so the comment overstates and mischaracterizes supported input.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The JSON payload consists entirely of Chinese-language headers and content, with no indication that the language is optional or tied to a documented region-specific requirement. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.