Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
投标报价AI审查（免费）
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local quote-checking helper whose file access and Node script behavior match its stated purpose.
Install only if you want a Chinese-language local helper for checking bid quote line arithmetic and missing fields. It does not replace legal, procurement, or bid committee review, and its documented free version intentionally omits broader bid checks.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)
Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
脚本本身不做计算，真正的检查在同目录的 `scripts/engine/quote-audit.js`（纯 Node 标准库，CommonJS），可以直接引用：
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
脚本本身不做计算，真正的检查在同目录的 `scripts/engine/quote-audit.js`（纯 Node 标准库，CommonJS），可以直接引用：
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Natural-Language Policy Violations
Medium
- Confidence
- 93% confidence
- Finding
- The file's user-facing documentation, usage text, errors, and status messages are entirely in Chinese, and there is no indication that other languages are supported or that the user can opt into this locale. Under the policy for natural-language violations, a skill that forces a specific language without user choice should be flagged unless the locale restriction is clearly documented and justified.
Natural-Language Policy Violations
Low
- Confidence
- 94% confidence
- Finding
- The fmt() function hard-codes toLocaleString('en-US'), which imposes a specific language/locale convention for numeric formatting. This is a natural-language/locale policy concern because the file otherwise contains Chinese-language user-facing text, and there is no user choice or justification for forcing U.S. formatting.
Natural-Language Policy Violations
Low
- Confidence
- 94% confidence
- Finding
- The file contains only Chinese text in a template string, which implies a fixed language/locale without any opt-in or alternative. Under the policy rules, forcing a specific language can be a natural-language policy violation when no user choice or justification is provided.
Static analysis
No suspicious patterns detected.