投标文件全流程智能分析

• Outcome: Review
• Latest audit: Jun 18, 2026 · 4:39 PM UTC
• Version: 1.0.0

Overview

The skill mostly does what it claims, but its HTML report generation can embed untrusted tender text as active browser content, so it should be reviewed before installation.

Install only if you are comfortable with a tender-analysis skill reading sensitive bid files and saving local report/version artifacts. Treat generated HTML reports as untrusted until the publisher escapes or sanitizes all document-derived fields, and confirm where snapshots and reports will be written before using auto-revision or version-management features.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The documentation explicitly instructs execution of local Python binaries and scripts, which expands the skill from passive document analysis into local code execution. If arguments or input files are influenced by user content, this can enable unsafe subprocess use, arbitrary file access, dependency abuse, or execution of unreviewed local scripts on the host environment.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The report builder interpolates untrusted fields such as project metadata, requirements, review text, revisions, and risks directly into HTML without escaping. If any parsed tender content contains HTML or JavaScript payloads, opening the generated report can trigger stored XSS/active content execution in the viewer's browser, which is especially dangerous because this skill processes attacker-controlled document content and then renders it into an interactive HTML artifact.

Vague Triggers

Medium

• Confidence: 77% confidence
• Finding: The trigger list includes broad terms such as technical proposal, automatic modification, and generic English tender phrases, which can cause the skill to activate in contexts broader than intended. Over-broad activation is risky here because the skill is designed to parse files, modify content, and create saved artifacts, so accidental invocation could expose documents or alter user material unexpectedly.

Vague Triggers

Medium

• Confidence: 75% confidence
• Finding: The capability-matrix examples use short, generic prompts like '流程图', '自动修订', and '版本对比' without scope constraints. In a skill that can read files, generate outputs, and maintain version history, such generic triggers raise the chance of unintended execution and silent processing of sensitive procurement documents.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill prominently offers automatic revision and versioned output but does not provide an upfront warning that it may modify user content and create persistent saved artifacts. In this context, silent document rewriting and snapshot creation can affect sensitive bid materials, create unintended retention, and cause users to lose track of what was changed and where it was stored.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 投标文件智能分析技能 - Python依赖包

# Document parsing (文档解析)
pymupdf>=1.21.0
python-docx>=0.8.11
openpyxl>=3.0.10

• Confidence: 93% confidence
• Finding: Using a lower-bound version specifier like 'pymupdf>=1.21.0' leaves installations non-reproducible and permits resolution to future versions that may introduce breaking changes or newly disclosed vulnerabilities. In a skill that parses untrusted bid documents, dependency drift increases supply-chain risk and can expose document-processing attack surfaces unexpectedly.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Document parsing (文档解析)
pymupdf>=1.21.0
python-docx>=0.8.11
openpyxl>=3.0.10

# Data processing (数据处理)

• Confidence: 94% confidence
• Finding: Using 'python-docx>=0.8.11' allows uncontrolled upgrades and undermines reproducible builds, which is a supply-chain hygiene weakness. Because this skill ingests DOCX files from external sources, unexpected library changes can directly affect the security of document parsing paths.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Document parsing (文档解析)
pymupdf>=1.21.0
python-docx>=0.8.11
openpyxl>=3.0.10

# Data processing (数据处理)
pandas>=1.5.0

• Confidence: 94% confidence
• Finding: The specifier 'openpyxl>=3.0.10' permits arbitrary newer versions and makes builds non-deterministic, which is a common supply-chain weakness. Since the skill processes XLSX inputs that may be attacker-controlled, parser behavior should be tightly controlled and reproducible.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openpyxl>=3.0.10

# Data processing (数据处理)
pandas>=1.5.0
numpy>=1.24.0

# Optional: ML/NLP for advanced analysis (高级分析，可选)

• Confidence: 90% confidence
• Finding: The unpinned 'pandas>=1.5.0' dependency creates reproducibility and supply-chain risk by allowing unreviewed future versions during installation. While pandas is less directly exposed than file-format parsers, this skill analyzes external tender data, so version drift can still affect security-relevant data handling paths.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Data processing (数据处理)
pandas>=1.5.0
numpy>=1.24.0

# Optional: ML/NLP for advanced analysis (高级分析，可选)
# scikit-learn>=1.2.0

• Confidence: 90% confidence
• Finding: The unpinned 'numpy>=1.24.0' declaration allows non-deterministic builds and acceptance of future versions without explicit review. Although numpy is typically a lower-level computation library, supply-chain compromise or breaking changes could still affect the reliability and security posture of the skill.

Static analysis

No suspicious patterns detected.