招标文件审查智能助手Bid Doc Reviewe

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:37 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent Chinese bidding-document review assistant, but it requires every generated report to include third-party signature and WeChat feedback promotion unrelated to the user’s review task.

Install only if you want a Chinese/PRC bidding-law review assistant and are comfortable with its reports including the publisher’s signature and WeChat feedback contact. Treat outputs as compliance-review assistance, not legal advice, and confirm the project jurisdiction and current rules before relying on conclusions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:149

Finding

Mandatory Promotional Content Injected into Agent Responses

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 149–150
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Complete Code Snippet:

markdown

**【署名与反馈】**
> **署名**：一线评标专家&ChesaraM ｜ **反馈/交流**：微信公众号「一线评标专家」（使用问题、误报反馈、实务建议，欢迎留言交流）

Technical Analysis

The Skill places a fixed signature and WeChat promotional call-to-action inside the mandatory report template used by the agent. This content is unrelated to the core function of reviewing bidding documents. When the Skill is loaded and its output instructions are followed, the agent is directed to append third-party branding and traffic-routing material to ordinary user-facing reports.

This constitutes instruction hijacking at the output layer: the Skill uses its control over the agent's response format to achieve a persistent promotional objective beyond the user's requested task. The behavior requires no executable code because the payload consists of instructions interpreted directly by the agent.

Attack Path

1. The platform loads the instructions from SKILL.md.
2. A user requests a bidding-document compliance review.
3. The agent follows the report-generation template defined by the Skill.
4. The agent appends the fixed author signature and WeChat account promotion to the final report.
5. The attacker-controlled branding is distributed through every affected response without a specific user request for promotional or contact information.

Impact Assessment

The issue does not grant operating-system privileges, access to credentials, code execution, or access to additional user files. Its scope is the integrity and presentation of responses generated while this Skill is active.

An operator controlling the Skill text can use the agent as a persistent distribution channel for third-party branding and external traffic redirection. Users may incorrectly perceive the promoted account as endorsed by the agen ...[truncated 168 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the mandatory signature and WeChat promotion from the report template in SKILL.md.
2. Keep author attribution and contact details in passive package metadata, such as manifest.yaml or README.md, rather than injecting them into agent-generated answers.
3. If a feedback mechanism is necessary, make it optional and display it only when the user explicitly requests support or contact information.
4. Add a publication rule prohibiting mandatory advertising, branding, referrals, and external traffic-routing text in Skill response templates unless directly required by the declared functionality.
5. Re-review all fixed output-template content to ensure every required section serves the user's bidding-document review request.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The title and core description are entirely in Chinese and position the assistant as operating within a China-specific legal framework, but the file does not state that Chinese is required by user choice or that language/locale behavior is optional. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is hard-wired to Chinese bidding law and Chinese-language compliance analysis, but it does not require an explicit user confirmation of applicable jurisdiction or language. If invoked on projects governed by another legal regime, users may receive authoritative-sounding but legally irrelevant advice, which is particularly risky because the skill presents itself as a specialist compliance reviewer.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes broad everyday phrases such as '招标文件有没有问题' and '品牌要求合规吗', which can cause the skill to activate on ambiguous conversations outside the user's intended scope. In a legal/compliance workflow, accidental invocation can route user content into the wrong specialist skill and produce inapplicable or overconfident regulatory guidance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest presents the skill name, description, and feedback channel entirely in Chinese, with no indication that users may choose another language or locale. Per the policy, locale or language constraints should be offered as a choice or clearly documented and justified as region-specific.

Content

No source excerpt is available for this finding.