Security audit

招标文件萝卜坑识别专家（投标人版）Bid Carrot Pit 1.0.0

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Chinese tender-document review assistant with an optional local section-splitting script, but users should manually verify its legal citations before relying on complaint drafts.

Install only if you need Chinese procurement/tender-file exclusionary-clause review. Treat generated complaint language as a draft: verify the project type, legal system, and cited law through an authoritative legal source or counsel before filing, especially because one bundled demo contradicts the skill's own citation-separation rule.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The report states a strict rule that government procurement projects must not cite the Tendering and Bidding Law system, but the very next example payloads do exactly that. In a compliance-oriented skill that generates challenge/complaint language, this inconsistency can cause users to submit legally mismatched arguments, undermining credibility and potentially harming their procedural position.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: 文件标题及全文均以中文固定描述技能，没有说明可根据用户偏好切换语言，也未声明这是仅面向特定中文工作场景的受限技能。按规则，未获用户选择或无明确正当理由的语言/locale 强制约束属于自然语言政策问题。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill invokes a local script (python scripts/split_sections.py ...) and also writes an output file (sections.json), which implies file read/write and code-execution-adjacent capability without any declared tool scope or permission boundary. In an agent environment, this can lead to over-broad access, unintended file handling, or execution against attacker-supplied paths/documents because the runtime constraints are not explicitly limited.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill name and description are entirely written in Chinese and the operational instructions, examples, and trigger phrases throughout the file assume Chinese-language usage. There is no statement that users may choose another language or locale, nor any justification that the skill is restricted to Chinese-only use for compliance reasons.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The suggested trigger phrases are broad enough that the skill may activate on loosely related procurement or compliance requests without strong exclusion criteria. Unintended invocation matters here because the skill is designed to perform full-document analysis, potentially prompting unnecessary file processing, legal-style output, and use of optional script/file operations in contexts the user did not clearly intend.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file presents the skill output exclusively in Chinese across the full report and does not indicate that the user can choose another language or locale. Under the language/locale policy rule, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The clause requiring bidders to be locally registered for 3 years and provide local tax proof creates a clear local/provincial restriction that can exclude otherwise qualified suppliers without an evident necessity in the text. In the context of a tender-document anti-discrimination analysis skill, this is exactly the kind of geographically exclusionary condition that may indicate tailored or improper competition restrictions, making the finding more significant rather than less.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill name, author label, and full description are entirely in Chinese, and the description presents the skill as a standalone workflow without indicating that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all operational guidance exclusively in Chinese, and nowhere indicates that the user can choose another language or that the skill is intentionally limited to a Chinese-language/regional compliance context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Line L01 titles the file entirely in Chinese and indicates it is specialized for a particular workflow, while the document provides no option for user-selected language or locale. Under the policy, forcing a single language without opt-in is a natural-language policy violation unless the regional constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown template forces a single language/locale for all users through its headings, instructions, and output text. Under the policy, a fixed language without user opt-in or a documented region-specific justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: 该 markdown 文件适用 SQP-1。L208 的触发词中如“扫一下这份招标文件的萝卜坑”“这是不是量身定做的标”等表述偏自然语言化，且文档未给出明确的触发边界、限定上下文或负例，容易在用户泛泛讨论招标文件时被误触发。
Content: No source excerpt is available for this finding.