合同逐条要点与需盯条款清单·逐条挂原文

• Outcome: Review
• Latest audit: Nov 2, 2026 · 10:59 PM UTC
• Version: 0.1.5

Overview

Review before installing: external contract processing is insufficiently explained, and the checker can approve unsupported or incorrectly cited clauses.

Prefer local-only processing for confidential contracts. Before enabling external parsing, approve sharing the document or its URL and check the provider's data-handling terms, which remain unverified here. Manually verify every excerpt and citation even when validation passes. Install a reviewed copy and choose a fresh output filename to avoid overwriting existing files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The supplied code supports clause extraction, citations, and source/date recording, and its offline behavior matches the description. However, its substantive output is materially less complete than the declared deliverable: it deliberately leaves the overview and watch-clause analysis unfinished. The referenced check_clauses.py is neither supplied nor invoked here, so its checks cannot be attributed to this chunk. This is a functional scope mismatch, not evidence of hidden networking, exfiltration, or unrelated execution. Other skill components could potentially complete the workflow, but that behavior is not demonstrated by the supplied code.

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md

bash scripts/fixtures/run_fixtures.sh # 离线三档一次跑完，末行自报档数与不合枚数

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The installation command executes an unpinned npm CLI and retrieves skill content without an immutable repository revision. Although the finding incorrectly calls this an MCP server reference, the actual supply-chain weakness could expose the host and sensitive contracts to compromised upstream code.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The documented command runs an unpinned npm CLI and installs skill content without an immutable repository revision. This is a CLI supply-chain issue rather than an MCP server configuration issue, and compromised upstream code could execute with the installing user's access.

Content

No source excerpt is available for this finding.

The remote-parsing workflow lacks a warning that contract URLs or contents may be disclosed to an external parsing service.

Medium

• Category: Output Handling
• Confidence: 92% confidence

Finding

The remote parsing instructions do not clearly disclose that the external service receives contract URLs and processes contract contents. General confidentiality language and permission to use a paid parser do not establish informed consent for that disclosure, especially alongside the claim that the skill uploads nothing.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Remote contract parsing lacks a clear third-party data-processing warning and conflicts with the no-network assurance.

Medium

• Category: Output Handling
• Confidence: 94% confidence

Finding

The workflow routes remote contracts through an external parser without clearly explaining the resulting disclosure of URLs and contract contents. Broad no-network and no-upload assurances obscure this boundary even though the local scripts themselves are offline, creating a confidentiality risk for legal and commercial documents.

Content

No source excerpt is available for this finding.

Clause-summary entries can pass without the original-text quotation required by the manifest.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

verify_quotes returns without an issue when an entry contains no recognized quotation, and clause-row validation does not independently require one. An unsupported paraphrase with a syntactically valid locator and anchor can therefore pass without any source comparison, undermining the checker's central integrity guarantee.

Content

No source excerpt is available for this finding.

Location verification accepts one matching quotation despite documenting that every quotation is checked against every locator.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

Locator checks use any matching quotation, so one correctly located excerpt can mask another excerpt drawn from elsewhere in the source. Global existence checks do not prevent this misattribution, allowing a checklist to pass while associating contract language with the wrong page or line.

Content

No source excerpt is available for this finding.

Tainted flow: 'body' from pathlib.Path.read_text (line 104, file read) → pathlib.Path.write_text (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/collect_clauses.py (reported line 110)May include surrounding context.

python

p = Path(a.out)
        try:
            p.parent.mkdir(parents=True, exist_ok=True)
            p.write_text(body, encoding='utf-8')
        except OSError as e:
            print('取值域故障：写不到 %s（%s）' % (p, e.strerror or '原因未取到'))
            return 3