ClawHub
Back to skill

Security audit

标书查重专家Bid Dup Check

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly performs the advertised bid-document comparison, but it handles sensitive procurement data and forces a non-optional third-party attribution/contact footer into user-facing reports.

Install only if you are comfortable uploading sensitive bid documents into this agent workflow, retaining extracted JSON/images in the workspace until cleanup, and receiving reports with a mandatory author/WeChat footer. Prefer a locked runtime with reviewed dependencies and remove or make the footer optional for formal procurement or compliance reports.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:261
Finding

Mandatory Promotional Content Injected into All User-Facing Outputs

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:32
Finding

Runtime Installation of Unpinned Third-Party Dependencies

Content
View full analysis
= 3.9` - `python-docx >= 0.8.11`（docx 解析与报告生成） - `pypdf >= 3.0.0`（pdf 文本与元数据） 检测与安装方式（用托管 Python 的 pip）： ```bash python -c "import docx, pypdf; print('deps ok')" || pip install python-docx pypdf ``` 若导入失败，先安装再继续。若依赖安装失败，给出替代方案：提示用户将文档转为 `.txt` 后重新上传（`.txt` 仅需标准库即可解析）。 ``` `scripts/extract_documents.py:48-58`: ```python def _require(module_name, pip_name): try: return __import__(module_name) except ImportError: sys.stderr.write( f"[错误] 缺少依赖 `{pip_name}`。请在托管 Python 环境中执行：\n" f" pip install {pip_name}\n" ) sys.exit(2) ``` `scripts/build_report.py:58-65`: ```python def _require(module_name, pip_name): try: return __import__(module_name) except ImportError: sys.stderr.write( f"[错误] 缺少依赖 `{pip_name}`。请执行：pip install {pip_name}\n" ) sys.exit(2) ``` ### Technical Analysis The Skill directs the Agent to install `python-docx` and `pypdf` directly from the environment's configured Python package index whenever the imports fail. The installation command does not specify exact versions, hashes, a lock file, or a verified package repository. The documentation lists minimum versions, but the actual `pip install` command contains no constraints. It therefore resolves the latest compatible distributions available when the command runs. This makes the environment non-reproducible and expands the supply-chain trust boundary to mutable package-index content. The package names are consistent with the Skill's declared functionality, and the audit found no evidence t ...[truncated 1556 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
- `SKILL_DIR`：本 Skill 的根目录绝对路径，即本 `SKILL.md` 所在目录。其下的 `scripts/` 即脚本目录。

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README explicitly encourages users to upload bidding documents containing sensitive corporate and personal data such as phone numbers, bank accounts, ID-like registration numbers, addresses, and document metadata, but it does not provide any user-facing warning, consent notice, retention guidance, or handling expectations. In this context, the skill is designed to process exactly the kinds of commercially sensitive and privacy-relevant materials that could create confidentiality, privacy, or compliance exposure if users assume uploads are low-risk or improperly share third-party documents.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill instructs the agent to read and write local files (extract_documents.py, build_report.py, extracted.json, report outputs) but does not declare an explicit tool scope or allowed-tools boundary. That creates an authorization ambiguity where an agent/runtime may grant broader filesystem access than intended, increasing the chance of unintended file access or overwrite beyond the user-uploaded workspace.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The markdown explicitly states '仅支持中文标书', which imposes a language constraint on users. Under the policy, forcing a specific language or locale without offering a user choice or opt-in is a natural-language policy violation unless clearly justified as region-specific compliance tooling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file presents all operational guidance, schemas, and disclaimers exclusively in Chinese. Under the natural-language policy rule, forcing a specific language without user opt-in or a clearly documented locale justification is a policy concern because users who do not read Chinese may be unable to understand the skill's instructions and limits.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/build_report.py (reported line 60)May include surrounding context.

python
# ----------------------------------------------------------------------------
def _require(module_name, pip_name):
    try:
        return __import__(module_name)
    except ImportError:
        sys.stderr.write(
            f"[错误] 缺少依赖 `{pip_name}`。请在托管 Python 环境中执行：\n"

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/extract_documents.py (reported line 50)May include surrounding context.

python
# ----------------------------------------------------------------------------
def _require(module_name, pip_name):
    try:
        return __import__(module_name)
    except ImportError:
        sys.stderr.write(
            f"[错误] 缺少依赖 `{pip_name}`。请在托管 Python 环境中执行：\n"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script extracts sensitive document metadata such as author, last_modified_by, company, manager, title, and timestamps, then writes it into output JSON for downstream processing. In a bid-document review context, these fields can expose personal data, organization identifiers, editing history, and correlation signals beyond the minimum needed, increasing privacy and data-leakage risk if the JSON is retained, shared, or sent to an LLM service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script extracts embedded images to disk and records absolute filesystem paths in the JSON output. Absolute paths can reveal host filesystem structure, usernames, workspace layout, or tenant-specific environment details, and the extracted image files themselves may contain sensitive bid content that persists on disk longer than intended.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The natural-language instructions and usage guidance are all presented in Chinese, which effectively forces a specific language for users. The file does not indicate that the skill is region-specific or provide an opt-in or alternative language, so this is a language/locale policy concern under the stated rule.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.