T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:268- Finding
Unconditional promotional footer hijacks generated output
- Content
View full analysis
- Remediation
View remediation
Security audit
Bid Dup Check 1.1.0
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its bid-document screening purpose, but it should be reviewed because it handles sensitive bid data with weak disclosure/redaction and forces a promotional footer into generated outputs.
Review this skill before installing it on real procurement materials. Use it only with documents you are authorized to process, assume generated JSON/Markdown/DOCX files and extracted images may contain sensitive bid data, clean the workspace after use, and be aware that reports will include a fixed author/WeChat footer unless the skill is changed.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/build_report.py:115- Finding
Sensitive personal and financial values are rendered without masking
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:43- Finding
Runtime installation uses unpinned dependencies without integrity verification
- Content
View full analysis
= 3.9` - `python-docx >= 0.8.11`（docx 解析与报告生成） - `pypdf >= 3.0.0`（pdf 文本与元数据） ``` ### Technical Analysis The Skill instructs the agent to install `python-docx` and `pypdf` dynamically whenever the import check fails. The packages are not pinned to exact versions, no hashes are supplied, and no approved package index is specified. Python package installation may execute package build or installation code. Consequently, the effective code introduced into the environment can change after the Skill itself has been reviewed. Although the package names are consistent with the imported modules and no typosquatting is evident in the project, the installation process remains mutable and lacks integrity controls. The use of minimum-version constraints also permits future releases with incompatible or compromised behavior. ### Attack Path 1. The Skill runs in an environment where `docx` or `pypdf` is unavailable. 2. The dependency check returns a nonzero status. 3. The shell executes `pip install python-docx pypdf`. 4. `pip` resolves the current package versions from its configured package index. 5. A compromised release, compromised index, malicious mirror, or dependency-resolution manipulation supplies unsafe package code. 6. Installation or subsequent import executes that code with the permissions of the agent process. ### Impact Assessment Successful exploitation would run third-party code with the same operating-system privileges as the Skill process. Depending on the hosting environment, this could permit: - Reading bid documents and other files accessible to the process. - Modi ...[truncated 403 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `SKILL_DIR`：本 Skill 的根目录绝对路径，即本 `SKILL.md` 所在目录。其下的 `scripts/` 即脚本目录。
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README explicitly encourages users to upload multiple bid/tender documents and lists highly sensitive fields such as phone numbers, bank accounts, legal representatives, addresses, and social credit codes, but it does not provide any user-facing warning or handling guidance for personal and corporate data. In this context, omission of privacy, retention, access control, and consent guidance increases the risk of inappropriate collection, over-sharing, or unsafe processing of regulated and commercially sensitive information.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill directs the agent to read and write user files, invoke scripts, and emit artifacts, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent platform, missing tool scoping weakens least-privilege controls and can let the skill access broader filesystem capabilities than reviewers or users expect.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The markdown explicitly states '仅支持中文标书', which imposes a language constraint on users. Under the policy, forcing a specific language without offering a choice or documenting a justified region-specific compliance reason is a natural-language policy violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The privacy section claims files are only processed within the current session and not persisted outside it, but the workflow explicitly writes extracted.json, findings.json, markdown/docx reports, and extracted images to the workspace. This is a security-relevant documentation integrity issue because users may disclose sensitive bid documents under a false understanding of retention and storage behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file is entirely written as mandatory skill guidance in Chinese, including required report text and output conventions, with no indication that users may choose another language or that the skill is limited to a Chinese-only locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python # ---------------------------------------------------------------------------- def _require(module_name, pip_name): try: return __import__(module_name) except ImportError: sys.stderr.write( f"[错误] 缺少依赖 `{pip_name}`。请在托管 Python 环境中执行：\n"
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python # ---------------------------------------------------------------------------- def _require(module_name, pip_name): try: return __import__(module_name) except ImportError: sys.stderr.write( f"[错误] 缺少依赖 `{pip_name}`。请在托管 Python 环境中执行：\n"
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
All visible user-facing content in the README is presented only in Chinese, including the title, feature descriptions, usage instructions, and feedback channel. There is no indication that users may choose another language, nor is there a documented reason that the skill is intentionally restricted to a Chinese-language audience.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
The skill later states OCR is only performed if the agent has vision capability and otherwise must be skipped with a limitation note. Earlier, however, the environment section presents image extraction for OCR as a default part of processing, which conflicts with the later capability-conditional behavior and can mislead an implementer about what actually happens.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill's stated purpose is to generate structured duplicate-check/risk-screening reports for bidding documents. Adding fixed signature and WeChat feedback/promotion text is not required to perform detection or report rendering, and introduces an unrelated communication/branding capability into the output artifact.
- Content
Static analysis
No suspicious patterns detected.