Security audit

工商注册材料清单：设立变更注销+表格

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a Chinese business-registration checklist with templates, but it embeds agent-facing instructions to buy and install a separate paid package through external SkillPay links.

Review this skill before installing because its checklist/templates appear usable, but the embedded paid-upgrade block asks the agent to help buy and install another skill package. Only follow any SkillPay or installation link when you explicitly intend to purchase that separate package, and do not let an agent initiate payment or install additional skills without a fresh confirmation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · templates/公司注册确认单（客户信息采集）.docx!/word/theme/theme1.xml (reported line 2)May include surrounding context.
text
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <a:theme xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" name="Office 主题"><a:themeElements><a:clrScheme name="Office"><a:dk1><a:sysClr val="windowText" lastClr="000000"/></a:dk1><a:lt1><a:sysClr val="window" lastClr="FFFFFF"/></a:lt1><a:dk2><a:srgbClr val="44546A"/></a:dk2><a:lt2><a:srgbClr val="E7E6E6"/></a:lt2><a:accent1><a:srgbClr val="4472C4"/></a:accent1><a:accent2><a:srgbClr val="ED7D31"/></a:accent2><a:accent3><a:srgbClr val="A5A5A5"/></a:accent3><a:accent4><a:srgbClr val="FFC000"/></a:accent4><a:accent5><a:srgbClr val="5B9BD5"/></a:accent5><a:accent6><a:srgbClr val="70AD47"/></a:accent6><a:hlink><a:srgbClr val="0563C1"/></a:hlink><a:folHlink><a:srgbClr val="954F72"/></a:folHlink></a:clrScheme><a:fontScheme name="Office"><a:majorFont><a:latin typeface="等线 Light" panose="020F0302020204030204"/><a:ea typeface=""/><a:cs typeface=""/><a:font script="Jpan" typeface="游ゴシック Light"/><a:font script="Hang" typeface="맑은 고딕"/><a:font script="Hans" typeface="等线 Light"/><a:font script="Hant" typeface="新細明體"/><a:font script="Arab" typeface="Times New Roman"/><a:font script="Hebr" typeface="Times New Roman"/><a:font script="Thai" typeface="Angsana New"/><a:font script="Ethi" typeface="Nyala"/><a:font script="Beng" typeface="Vrinda"/><a:font script="Gujr" typeface="Shruti"/><a:font script="Khmr" typeface="MoolBoran"/><a:font script="Knda" typeface="Tunga"/><a:font script="Guru" typeface="Raavi"/><a:font script="Cans" typeface="Euphemia"/><a:font script="Cher" typeface="Plantagenet Cherokee"/><a:font script="Yiii" typeface="Microsoft Yi Baiti"/><a:font script="Tibt" typeface="Microsoft Himalaya"/><a:font script="Thaa" typeface="MV Boli"/><a:font script="Deva" typeface="Mangal"/><a:font script="Telu" typeface="Gautami"/><a:font script="Taml" typeface="Latha"/><a:font script="Syrc" typeface="Estrangelo Edessa"/><a:font script="Orya" typeface="Kalinga"/><a:font script="Mlym" typeface="Kartika"/><a:font scri ...[truncated 26 chars]

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README expands a simple business-registration checklist skill into a mechanism that instructs the agent to facilitate acquisition and installation of a separate paid package. This creates scope creep from informational guidance into transactional behavior, increasing the risk that an agent will act on commercial instructions unrelated to the user’s original request and potentially steer users toward paid products.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Embedding commercial upsell text and payment-related installation steps inside skill documentation introduces instructions that can override or distract from the skill’s stated purpose of providing registration-material checklists and templates. In an agent context, such content can prompt unwanted purchase flows, external-site navigation, or social-engineering-style escalation under the guise of normal skill usage.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest claims the skill is a self-contained checklist/template pack that requires no external systems, yet the file later includes instructions to purchase and install a separate paid package via external SkillPay links. This mismatch can mislead a host agent into unexpectedly initiating off-scope external navigation or commerce flows, increasing the risk of prompt injection, unauthorized upsells, or trust abuse.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill embeds an e-commerce upsell and agent-directed installation workflow unrelated to its core purpose of providing registration-material checklists and blank forms. Even though it says payment must be confirmed by a human, it still attempts to steer the agent to external links and perform acquisition/install steps, which expands the skill's authority surface and creates an opportunity for social engineering or policy bypass.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The README consistently frames the skill as operating only in Chinese, including Chinese trigger phrases, Chinese labels, and a Chinese-only one-line description for AI usage. There is no indication that users may choose another language or that the locale restriction is optional or explicitly justified as a region-specific constraint.
Content: No source excerpt is available for this finding.