招投标处理专家

• Outcome: Review
• Latest audit: Sep 23, 2026 · 8:45 AM UTC
• Version: 1.0.10

Overview

This is a local bidding-analysis skill, but it needs review because it writes a local usage counter and has documentation that does not consistently match the checks it runs.

Review before installing. Use it only if you are comfortable running a local Node/Bash tool on bidding or financial tables, and be aware it stores a small local usage counter in your home directory and stops after the free-use limit. Treat its compliance and collusion outputs as aids to review, not authoritative legal or procurement decisions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (40)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: Advertising a simple table-driven 7-skill dispatcher while actually requiring multiple structured fields and running a different audit bundle is a material trust and safety defect. Because this skill is used for tender/compliance decisions, the mismatch increases the chance of false negatives, incorrect conclusions, and overreliance on incomplete checks.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: Advertising a simple table-driven 7-skill dispatcher while actually requiring multiple structured fields and running a different audit bundle is a material trust and safety defect. Because this skill is used for tender/compliance decisions, the mismatch increases the chance of false negatives, incorrect conclusions, and overreliance on incomplete checks.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Advertising a simple table-driven 7-skill dispatcher while actually requiring multiple structured fields and running a different audit bundle is a material trust and safety defect. Because this skill is used for tender/compliance decisions, the mismatch increases the chance of false negatives, incorrect conclusions, and overreliance on incomplete checks.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: Advertising a simple table-driven 7-skill dispatcher while actually requiring multiple structured fields and running a different audit bundle is a material trust and safety defect. Because this skill is used for tender/compliance decisions, the mismatch increases the chance of false negatives, incorrect conclusions, and overreliance on incomplete checks.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Advertising a simple table-driven 7-skill dispatcher while actually requiring multiple structured fields and running a different audit bundle is a material trust and safety defect. Because this skill is used for tender/compliance decisions, the mismatch increases the chance of false negatives, incorrect conclusions, and overreliance on incomplete checks.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: Advertising a simple table-driven 7-skill dispatcher while actually requiring multiple structured fields and running a different audit bundle is a material trust and safety defect. Because this skill is used for tender/compliance decisions, the mismatch increases the chance of false negatives, incorrect conclusions, and overreliance on incomplete checks.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Advertising a simple table-driven 7-skill dispatcher while actually requiring multiple structured fields and running a different audit bundle is a material trust and safety defect. Because this skill is used for tender/compliance decisions, the mismatch increases the chance of false negatives, incorrect conclusions, and overreliance on incomplete checks.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file header promises the package only performs a single arithmetic-check function and does not use the full seven-check workflow, but the implementation later executes six additional analyses and reports complete seven-check coverage. This is a security-relevant integrity issue because downstream callers, policy gates, billing logic, or human operators may rely on the documented behavior and unknowingly process broader analyses than authorized or expected.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The comments describe the extra six checks as subscription-only, but run() executes them unconditionally for every input and even sets output metadata claiming full seven-check coverage regardless of entitlement. In a skill that produces compliance and collusion findings, this mismatch can bypass packaging, licensing, approval, or workflow boundaries and cause unauthorized analysis results to be treated as legitimate.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file advertises a tiered capability model where only two checks should run in this package, but the implementation unconditionally executes all eight checks. This creates a trust and authorization boundary failure: callers, buyers, and surrounding orchestration may rely on documented feature gating, yet the engine exposes premium logic regardless of entitlement.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The main entrypoint computes a paid/full-tier signal but then ignores it and always runs the additional six checks. This discrepancy can bypass business controls, leak proprietary detection logic, and produce outputs that downstream systems may treat as licensed or approved even when the caller is not entitled to them.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The file header explicitly claims the package only performs two checks and does not read tenderText/contractText, but run() actually processes those fields and executes four extra analyses. In a compliance-audit skill, this kind of deceptive or stale documentation is dangerous because operators may provide sensitive tender/contract text under false assumptions, and downstream controls may rely on the stated scope when making trust or privacy decisions.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The run() docstring says the package executes only two AI checks, but the function also runs tender-element scanning, contract-clause scanning, cross-bidder collusion heuristics, and unified blocking logic. In this skill context, inaccurate interface documentation can cause callers to expose additional sensitive material or make governance decisions based on an incomplete understanding of what the engine does.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The returned note states that only arithmetic and placeholder checks are covered and that other checks were not executed, yet the result object already includes findings from tender, contract, collusion, and blocking analyses. This is dangerous because it creates false audit provenance: users, reviewers, or automation may trust the note and mis-handle sensitive findings, misunderstand the basis for a block decision, or incorrectly attest what analyses were performed.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The header claims the public version performs 'no counting', but the implementation later persists a per-user usage counter under the home directory. This deceptive disclosure can undermine informed consent and trust, and in security-sensitive environments hidden local persistence may violate operator expectations or policy even if the stored data is minimal.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The help and listing text state that all sub-skills are included locally with full functionality, while the control flow later denies execution for sub-skills only available in the subscription edition. This is not memory-unsafe code, but it is a deceptive capability claim that can mislead users into trusting availability and completeness guarantees that are not actually provided.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The skill name, summary, and operational description are presented as Chinese-only for user interaction, and the examples/instructions assume Chinese input such as '贴一张表进来' and Chinese field expectations. Although an English one-line description exists, the file does not offer users a language/locale choice or state that Chinese is optional, which can violate language/locale policy requirements.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The keyword set for this subskill includes generic terms such as “免费”, “对账”, and “核对”, which are not specific to the intended function and can cause the wrong skill to activate on unrelated user inputs. Misrouting is security-relevant here because this skill family performs compliance-style analysis and may produce authoritative conclusions on the wrong dataset or expose unintended functionality.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: This keyword list mixes narrow terms with broad bidding-related phrases like “招投标”, “评标”, and “免费”, making activation ambiguous across multiple neighboring subskills in the same domain. In a multi-skill bidding assistant, broad overlap increases the chance that a user request is routed into the wrong analytical workflow, producing incorrect or overbroad processing.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The activation phrases again include generic terms such as “免费”, “对账”, and “核对”, which are common across unrelated finance and document-review scenarios. Because this subskill handles deposit/refund reconciliation, accidental invocation could lead to misleading financial exception findings or inappropriate data handling on the wrong records.

Static analysis

No suspicious patterns detected.