投标机会顾问

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:58 AM UTC
• Version: 1.0.0

Overview

This skill appears to be a legitimate public-procurement bid advisor, with disclosed local profile/report files and public-source fetching that users should explicitly control.

Install only if you are comfortable with the agent reading or creating a local company profile, saving procurement HTML/JSON/report files, and querying public procurement sites. Keep ~/.bidprofile.json limited to necessary business facts, avoid embedding confidential strategy in search keywords, and require explicit confirmation before any WebSearch/WebFetch, direct --kw fetch, credential use, or report/profile write.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (46)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill claims it only provides analysis and recommendations, yet it also instructs creation and persistence of a company profile in ~/.bidprofile.json. Persisting company identity, qualifications, products, and region to disk introduces confidentiality and data-retention risk, especially because this information may be commercially sensitive and the storage behavior is not prominently disclosed as core functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims it only provides analysis and recommendations, yet it also instructs creation and persistence of a company profile in ~/.bidprofile.json. Persisting company identity, qualifications, products, and region to disk introduces confidentiality and data-retention risk, especially because this information may be commercially sensitive and the storage behavior is not prominently disclosed as core functionality.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md

**架构原则**：取数是 agent 的受控动作，脚本 `fetch_ccgp.py` 只负责解析落 JSON、不擅自联网。两步配合：

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md

**架构原则**：取数是 agent 的受控动作，脚本 `fetch_ccgp.py` 只负责解析落 JSON、不擅自联网。两步配合：

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

**架构原则**：取数是 agent 的受控动作，脚本 `fetch_ccgp.py` 只负责解析落 JSON、不擅自联网。两步配合：

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

md

**架构原则**：取数是 agent 的受控动作，脚本 `fetch_ccgp.py` 只负责解析落 JSON、不擅自联网。两步配合：

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

python scripts/fetch_ceb.py --html-dir ./ceb_html/ \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md

python scripts/fetch_ceb.py --html-dir ./ceb_html/ \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

md

python scripts/fetch_ceb.py --html-dir ./ceb_html/ \

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script includes an active network-fetch path that connects to external CCGP endpoints and retrieves listing/detail data when --kw or --details is used. That behavior exceeds the declared skill boundary of analysis-only and 'not sending data externally without authorization', making the skill capable of unsolicited outbound network activity in contexts where operators may assume it is offline-only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

文件标题及全文均以中文撰写，且未说明这是可选语言、未提供多语言支持，也未声明该技能仅面向特定中文地区用户。按规则，强制特定语言而无用户选择属于自然语言策略违规。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file presents all operational instructions and warnings exclusively in Chinese, which can amount to a language/locale policy violation when no user opt-in or justification is provided. The content does not indicate that the skill is region-specific or that users may choose another language.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill describes capabilities that require file reads/writes, shell execution, and network access, but it does not declare an explicit tool scope or permission boundary. This is dangerous because a reviewer or runtime may grant broader access than users expect, enabling local file access and outbound fetching without clear least-privilege constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file forces a specific language/locale in its display name, description, instructions, examples, and outputs, but does not state that the user can choose another language. Under the policy, forcing a language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The architecture explicitly includes network-based data acquisition via WebFetch/Bash and external sources, which conflicts with the stated privacy boundary that the skill only analyzes/advises and does not send data externally without authorization. In an agent setting, this mismatch can cause the skill to initiate outbound requests based on user-provided company or bid context without a clear consent checkpoint, creating a data handling and expectation-trust issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Fetching raw HTML to disk via WebFetch/Bash introduces two sensitive behaviors: outbound network access and local data persistence. Without an explicit user-facing warning and consent model, the skill may store potentially sensitive query context or fetched content locally and contact third-party systems in ways the user does not expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document declares lang="zh-CN", which hard-codes a specific language/locale for the skill output. Under the policy, locale-specific behavior should either be user-selectable or clearly justified as region-specific; this file provides neither.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The JSON dataset stores all human-readable titles, types, summaries, and organization names in Chinese only, with no indication that language selection is configurable or optional. Under the stated policy, a file that hard-codes a single language/locale for user-facing natural language can violate locale-choice requirements when no opt-in or justification is provided.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest describes a skill for advising on whether to pursue tenders and related bidding fit, but this file contains records such as '软件工程学科平台设备采购' and 'RPA机器人采购项目' that are not '标讯顾问' inputs aligned with the documented smart-campus/tender-focused examples. Including unrelated procurement domains indicates the skill’s actual data basis extends beyond the described purpose-specific opportunity analysis corpus.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This JSON file is a manifest-type file, so vague-trigger checks apply. The listed terms such as "软件", "平台", "信息化", and "智慧" are generic words that overlap with common business and technology discussions, making activation scope unclear if these fields are used to describe when the skill should run.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest presents the skill name, author-facing text, description, and feedback note entirely in Chinese, with no indication that language is configurable or limited to a Chinese-speaking audience. This creates a natural-language locale policy concern because the skill appears to impose a specific language without explicit user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation explicitly instructs the agent to perform live network fetching via WebFetch, curl, and urllib, which conflicts with the skill’s stated boundary that it only performs analysis and does not send data externally without authorization. This creates a real capability/expectation mismatch: an integrator or downstream agent may initiate external requests by default, potentially transmitting user-supplied keywords, company profile information, or search behavior to third-party procurement sites without an explicit authorization step.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The section recommends cross-site querying and aggregation across ccgp, cebpubservice, and WebSearch as a fallback, extending the skill from passive analysis into active multi-source retrieval. Even if the purpose is legitimate procurement research, this broadens data egress and increases the chance that sensitive user interests, bid targets, or internal sourcing strategy are disclosed to external services, especially when fallback behavior is automatic.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module documentation states that the script does not use active network retrieval as its main path and implies it does not self-initiate connectivity, yet the implementation contains built-in code paths for direct online fetching. This documentation/code mismatch is dangerous because reviewers, integrators, or policy engines may trust the declared boundary and deploy the tool in environments where outbound access is unexpected or prohibited.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

该技能的陈述重点是对标讯做适配性、可行性和报价建议分析，而本文件除解析外，还在 --run 分支中通过 subprocess.run 启动 opportunity_engine.py。对一个数据解析/顾问型技能而言，生成分析可直接在进程内完成；引入子进程执行能力扩大了操作面，且该能力并未在技能描述中单独说明。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.