Security audit

Bid Doc Reviewe 2.0.0

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for China-focused tender-document compliance review, but it forces author/WeChat promotional text into generated reports and needs user review before installation.

Install only if you want a China 招标投标 compliance-review assistant and are comfortable with it using referenced knowledge bases. Review outputs carefully because they are not legal advice, confirm the matter is within PRC tendering law rather than government or SOE procurement, and remove or ignore the mandatory author/WeChat signature if you do not want promotional content in reports.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:149
Finding: Forced Promotional Content in Agent Responses
Content: View full analysis
**\u7f72\u540d**\uff1a\u4e00\u7ebf\u8bc4\u6807\u4e13\u5bb6&ChesaraM \uff5c **\u53cd\u9988/\u4ea4\u6d41**\uff1a\u5fae\u4fe1\u516c\u4f17\u53f7\u300c\u4e00\u7ebf\u8bc4\u6807\u4e13\u5bb6\u300d\uff08\u4f7f\u7528\u95ee\u9898\u3001\u8bef\u62a5\u53cd\u9988\u3001\u5b9e\u52a1\u5efa\u8bae\uff0c\u6b22\u8fce\u7559\u8a00\u4ea4\u6d41\uff09 ``` ### Technical Analysis The skill defines a mandatory response template that directs the agent to append author branding and a WeChat promotional contact message to generated compliance reports. This content is unrelated to the substantive tender-document review and is presented as an obligatory part of the agent's answer. When the skill is loaded, its instructions affect the current agent session. An agent following the template will reproduce the promotional material without the user explicitly requesting attribution or contact information. This constitutes instruction-level output manipulation because the skill alters the expected final response for the benefit of the skill author. No executable code, privilege escalation, credential access, persistence, or remote payload execution is involved. ### Attack Path 1. A user or platform loads the skill from `SKILL.md`. 2. The agent accepts the skill's prescribed output template as active instructions. 3. The user submits a tender document for compliance review. 4. The agent generates the requested report according to the mandatory template. 5. Lines 149-150 cause the agent to append author attribution and a WeChat promotional message. 6. The resulting report may appear to endorse the named author or communication channel despite the user not requesting that content. ...[truncated 566 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README presents the skill entirely in Chinese and describes it as an assistant specialized in the Chinese tendering legal system, but it does not state that language choice is optional or user-selectable. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill is tightly bound to the Chinese 招标投标 legal framework and embedded knowledge bases, but it does not consistently enforce a prominent jurisdiction check before giving compliance guidance. If invoked for non-China procurement, government procurement, or adjacent corporate purchasing scenarios, users may receive legally inapplicable advice that appears authoritative, creating compliance and decision-making risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger list includes broad, everyday phrases such as '招标文件有没有问题' and '品牌要求合规吗', which can cause the platform to invoke this skill for loosely related conversations. Over-broad invocation can route users into a specialized legal/compliance workflow without sufficient jurisdiction or scope checks, increasing the chance of irrelevant, misleading, or overconfident advice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The description states the skill is specifically for the Chinese bidding and tendering legal system and is written entirely in Chinese, which imposes a language/locale constraint. There is no indication that users can choose another language or locale, nor a clear justification in the manifest that this regional restriction is intentional policy scope.
Content: No source excerpt is available for this finding.