标书制作专家

• Outcome: Review
• Latest audit: Jun 26, 2026 · 11:38 AM UTC
• Version: 0.0.2

Overview

This is a coherent bid-document drafting skill, but users should treat tender files, company records, pricing, and identity details as sensitive.

Install only if you are comfortable letting the skill read tender files you explicitly upload or path-reference and create bid-document outputs. Redact unnecessary ID numbers, pricing, credentials, and proprietary details where possible; confirm output paths before generation; and use patched document-parsing libraries, preferably in a sandbox for untrusted PDFs or Word files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (24)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrases include the very generic term "标书" without stronger contextual constraints, which can cause the skill to activate on broad, ambiguous user requests unrelated to bid-response generation. In a document-handling skill that processes tender, corporate, and legal materials, over-broad invocation increases the chance of unnecessary exposure of sensitive files and misrouting user tasks into a high-trust workflow.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly invites users to upload PDF/Word tender documents and corporate qualification materials, which commonly contain confidential pricing, business strategy, personal identity documents, and regulated company data, yet it provides no warning or handling guidance for sensitive content. This omission can lead users to disclose high-value commercial and personal information without informed consent or minimization safeguards.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases are broad natural-language requests such as 'Help me prepare a bid submission' and 'Generate a response to this RFP', which could match ordinary conversation and invoke the skill without the user explicitly intending to use it. In an agent environment with multiple tools and file access, this increases the chance of unintended activation on sensitive tender documents or premature workflow execution.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The activation phrases are generic proposal-work requests such as creating a bid response or preparing an offer, so they can match ordinary user conversation and trigger the skill unintentionally. Because this skill processes uploaded files and file paths, accidental activation could cause the agent to analyze sensitive tender documents or start a multi-step workflow without clear user intent.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrase « Préparer une offre » is overly generic and can match ordinary user requests that are not specifically about tender-response generation. In an agent environment with automatic skill routing, this can cause unintended invocation on unrelated content, exposing uploaded files or steering the assistant into an inappropriate workflow without clear user intent.

Vague Triggers

Low

• Confidence: 83% confidence
• Finding: The README states that the skill can be triggered by one of several phrases, but it does not define activation boundaries, exclusions, or required context. This ambiguity increases the chance of accidental activation and misrouting, especially because the skill processes local file paths and procurement documents that may contain sensitive business information.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger phrases are very broad, everyday requests like 'create a bid document' or 'help prepare a response,' which can cause the skill to activate during ordinary document-assistance conversations without clear user intent to invoke this specific capability. In a file-processing skill that ingests tender documents and generates formal bid content, overbroad activation increases the chance of unintended document handling, incorrect workflow takeover, or surprise use of external file paths.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The quick-start phrases are generic requests such as asking for help preparing an RFP response or bid document, which can easily overlap with ordinary user intent outside this specific skill. In an agent ecosystem with phrase-based routing, this can cause the skill to auto-trigger unexpectedly, exposing uploaded files or causing the agent to perform high-impact document generation actions without sufficiently explicit user selection.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger phrases are very broad generic tender-related requests, which can cause the skill to activate for ordinary user queries without clear user intent to invoke this specific capability. In an agent environment that auto-routes by phrase matching, this increases the risk of unintended document processing, confusing agent behavior, or accidental handling of sensitive procurement files.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The listed trigger phrases are very generic requests such as '帮我做标书' and '生成投标文件', which can overlap with ordinary user intents and cause the skill to activate when the user did not explicitly intend to invoke it. In an agent environment with file access and multi-step automation, overly broad activation increases the chance of unintended document processing, unexpected file access, or confusing takeover of a general conversation.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The documented trigger phrases are very broad, everyday requests such as '幫我做標書' and '寫應標書', which increases the chance of unintended or ambiguous activation in normal conversation. Because this skill performs a multi-step document-processing workflow, accidental invocation could cause the agent to begin analyzing or generating bid documents without sufficiently explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README advertises automatic processing of uploaded files and a 6-stage workflow, including unattended PDCA improvement, but does not clearly warn users about file read/write behavior, persistence, or whether documents may be modified or generated automatically. In a skill that handles sensitive tender documents, missing disclosure reduces informed consent and can lead to unintended processing of confidential business information or unexpected document creation.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The instructions explicitly process user-supplied tender files and generate output documents, but they do not warn users that uploaded files may contain sensitive commercial, financial, or personal data, nor do they clarify where generated documents are written. In a bid-document workflow, this omission can lead to unintended disclosure, unsafe handling of confidential procurement data, or accidental overwriting/creation of files without clear user awareness.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The template explicitly requests highly sensitive personal data such as national ID numbers and ID card copies without any guidance on minimization, masking, storage, or transmission controls. In a bid-document generation skill, this creates a realistic risk of over-collection and unsafe inclusion of personal data in generated artifacts, which could lead to privacy violations, identity theft exposure, or noncompliance with data protection requirements.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The authorization template requires the agent to include an agent's ID number and ID card copies, again without any warning or protective handling instructions. Because this skill is specifically designed to transform source documents into polished bid packages, the omission is more dangerous in context: users may paste raw identity documents into the workflow and unknowingly propagate sensitive PII into outputs or logs.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The business license template aggregates sensitive corporate identifiers and location details that can facilitate profiling, impersonation, or targeted fraud if redistributed broadly. While some of this information may be standard in procurement, the template provides no caution about disclosure scope, so users may include more information than necessary or share it inappropriately.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- "Help me prepare a bid submission"
- "Generate a response to this RFP"

The AI will automatically execute a 6-stage workflow: **Parse Tender → Strategy Analysis → Outline Generation → Chapter Writing → Quality Check → PDCA Auto-Improvement**

## Usage

• Confidence: 84% confidence
• Finding: Stating that the AI will 'automatically execute a 6-stage workflow' encourages autonomous multi-step behavior, including document parsing, strategy analysis, and content generation, before clear user checkpoints are established. In a file-I/O capable agent, this can lead to overbroad processing of uploaded documents, unintended actions, or generation of misleading procurement content without sufficient human review.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 安装: pip install -r requirements.txt

# PDF解析
PyPDF2>=3.0.0
pdfminer.six>=20221105      # 更强大的PDF解析，支持中文

# Word文档解析与生成

• Confidence: 94% confidence
• Finding: Using a lower-bounded dependency like PyPDF2>=3.0.0 makes builds non-reproducible and can pull in unexpected versions over time, including versions with new bugs or incompatible behavior. In a document-processing skill that handles untrusted PDFs, dependency drift increases supply-chain and stability risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pdfminer.six>=20221105      # 更强大的PDF解析，支持中文

# Word文档解析与生成
python-docx>=1.0.0

# Markdown处理
markdown>=3.5.0

• Confidence: 92% confidence
• Finding: python-docx>=1.0.0 is unpinned, so installations may resolve to different versions in different environments. This weakens reproducibility and can introduce unreviewed behavior changes or future vulnerable releases into a system that processes external documents.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-docx>=1.0.0

# Markdown处理
markdown>=3.5.0

# 文档格式转换（可选）
pandoc>=2.3                 # 需要系统安装pandoc

• Confidence: 93% confidence
• Finding: An unpinned markdown dependency allows future package versions to be installed without review, which is a common supply-chain hygiene issue. Because this skill converts and renders document content, unexpected parser behavior from drifting versions can affect reliability and security posture.

Known Vulnerable Dependency: PyPDF2==3.0.0 — 1 advisory(ies): CVE-2023-36464 (pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a chara)

Low

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: PyPDF2 3.0.0 is flagged for a known infinite-loop denial-of-service issue when parsing crafted PDF content. This skill explicitly processes tender PDFs from external sources, so malformed inputs could cause hangs or resource exhaustion during document ingestion.

Known Vulnerable Dependency: pdfminer.six==20221105 — 2 advisory(ies): CVE-2025-70559 (Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc); CVE-2025-64512 (Arbitrary Code Execution in pdfminer.six via Crafted PDF Input)

High

• Category: Supply Chain
• Confidence: 99% confidence
• Finding: pdfminer.six==20221105 is associated with serious advisories including possible arbitrary code execution and insecure deserialization. In this skill, pdfminer.six would parse attacker-controlled tender PDFs, which makes the context materially more dangerous because exploitation could occur through normal document processing workflows.

Known Vulnerable Dependency: markdown==3.5.0 — 2 advisory(ies): CVE-2025-69534 (Python-Markdown has an Uncaught Exception); CVE-2025-69534 (Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like se)

High

• Category: Supply Chain
• Confidence: 85% confidence
• Finding: If markdown==3.5.0 is affected by the cited advisory set, malformed input could trigger exceptions or parser instability during content conversion. In a bid-document generator, this is less severe than direct code execution but still relevant because untrusted or externally sourced text may be rendered or transformed as part of the workflow.

Possible Typosquatting: 'pandoc' resembles popular package 'pandas'

High

• Category: Supply Chain
• Confidence: 70% confidence
• Finding: Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/prompts/system-prompt.md:1