Security audit

浙江工程招投标中标查询（供应商视角）

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Zhejiang tender-history lookup tool that uses a remote service and local product credentials as disclosed.

Before installing, understand that this skill contacts the publisher's HTTPS service, sends your tender search query, and stores product credentials/cookies plus an install identifier in a plaintext file under ~/.odf. That behavior is disclosed and fits the product, but avoid placing unrelated secrets in that file and evaluate the publisher/service endpoint if the query data is sensitive.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Natural-Language Policy Violations

Medium

Confidence: 85% confidence
Finding: The skill is explicitly scoped to Zhejiang and is primarily described in Chinese, with invocation examples and trigger phrases centered on that locale. While region-specific functionality can be justified, the file does not clearly state that this locale restriction is an intentional user-facing constraint or offer any language/locale choice, which may conflict with locale-choice policy expectations.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This file contains natural-language output that forces a specific language/locale for users, beginning with the usage string and continuing throughout the script. Under the policy, language constraints should either be user-selectable or clearly justified as region-specific, which is not present here.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The script stores an API key, server-issued cookies, and an installation identifier in a local file under the user's home directory, then automatically replays them to a remote host by IP address. This creates a credential-handling and tracking surface that is broader than necessary for a simple data-delivery skill, and if the local file or remote endpoint is compromised, the user’s account access, quota, or purchased entitlement could be abused.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The script prints all operational, error, and payment-related messages only in Chinese, which enforces a single language for all users. There is no visible mechanism for choosing another language and no documented reason for the locale restriction in this file.

Intent-Code Divergence

Low

Confidence: 89% confidence
Finding: The comments state that no device information is collected, but the code accepts a server-issued cookie, persists it as an install identifier, and sends it back on future requests. Even if not derived from hostname or username, this still enables long-term installation-level tracking and creates a misleading privacy representation to users.

Static analysis

No suspicious patterns detected.