Security audit

投标报价策略沙盘 Bid Pricing Strategy Sandbox

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent local Chinese bid-pricing calculator, but its bundled HTML tool unsafely renders imported configuration data and CSV exports, which could let a malicious configuration mislead or attack users handling sensitive bid data.

Review before installing if users may import configurations from anyone they do not fully trust. Use only self-generated or trusted JSON, avoid opening exported CSVs with active spreadsheet features enabled, and prefer a fixed version that renders with textContent and safely encodes CSV fields.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: calculator.html:571
Finding: DOM-based cross-site scripting through imported configuration data
Content: View full analysis
"+b.label+"
"+fmt(b.value,$("unitInput").value)+" "+b.desc+""; bench.appendChild(d); }); var multi=out.detailScores.length>1; var tbl=$("resultTable"); var head="排名投标人"; for(var d=0;d"+out.benchmarkInfos[d].label+"维度分"):"报价"; head+= multi?"总得分":"得分"; head+="偏差率%推荐价"; var body=""; out.results.forEach(function(r,i){ var tr=""+r.rank+""+r.name+(i===0?" 🥇":"")+""; for(var d=0;d"+fmt(out.detailScores[d][i],"")+""):(""+fmt(r.prices[d],$("unitInput").value)+""); } tr+= ""+fmt(r.score,"")+""; tr+= ""+fmt(out.deviations[0][i],"")+""; tr+= ""+(multi?out.benchmarkInfos.map(function(b,di){return fmt(b.value,$("unitInput").value);}).join(" / "):fmt(out.recommendedPrice[0],$("unitInput").value))+""; body+=tr; }); tbl.innerHTML=head+body; var ws=$("warnSlot"); if(out.recommendationReason && out.recommendationReason.indexOf("⚠️")===0){ ws.innerHTML="
"+out.recommendationReason.split("。")[0]+"。
"; } else ws.innerHTML=""; $("recSlot").innerHTML="💡 策略建议："+out.recommendationReason; window.scrollTo({top:$("resultCard").offsetTop-10, behavior:"smooth"}); } ``` ### Technical ...[truncated 2793 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: calculator.html:598
Finding: Spreadsheet formula injection in exported CSV files
Content: View full analysis
1?"维度分":"报价")); h.push("总得分","偏差率%","推荐价"); rows.push(h.join(",")); out.results.forEach(function(r,i){ var line=[r.rank, r.name]; for(var d=0;d1?Math.round(out.detailScores[d][i]*100)/100:r.prices[d]); line.push(Math.round(r.score*100)/100, Math.round(out.deviations[0][i]*100)/100, out.recommendationReason.indexOf("⚠️")===0? (out.recommendedPrice.join("/")) : out.recommendedPrice.join("/")); rows.push(line.join(",")); }); rows.push(""); rows.push("基准价,"+out.benchmarkInfos.map(function(b){return b.label+"="+Math.round(b.value*100)/100+unit;}).join(" | ")); rows.push("策略建议,"+out.recommendationReason.replace(/,/g,"，")); var blob=new Blob(["\ufeff"+rows.join("\n")], {type:"text/csv;charset=utf-8"}); var a=document.createElement("a"); a.href=URL.createObjectURL(blob); a.download="报价得分测算.csv"; a.click(); toast("已导出 CSV"); } ``` ### Technical Analysis The export routine writes configuration-derived strings directly into CSV cells. Bidder names, dimension labels, and recommendation text can originate from an imported configuration. The implementation neither neutralizes spreadsheet formula prefixes nor performs complete CSV quoting. Spreadsheet applications may interpret cells beginning with `=`, `+`, `-`, or `@` as formulas. Some applications also recognize formula content after leading whitespace or control characters. Consequently, an attac ...[truncated 1803 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill instructions and required user-facing confirmations are written in Chinese and direct the AI to use fixed Chinese response phrases, but they do not offer the user any language or locale choice. This creates a natural-language policy concern because the skill effectively constrains interaction to a specific language without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The template is written entirely in Chinese and explicitly instructs the user to reply with Chinese terms such as "确认" at L23. This creates a language policy concern because it imposes a specific language for interaction without presenting an opt-in or alternative locale choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest presents the skill name, description, and feedback text entirely in Chinese, which indicates a fixed language/locale for user-facing interaction. There is no indication that users can opt into another language or that the skill is intentionally limited to a Chinese-only regional context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The page sets lang="zh-CN", and the visible UI text is entirely Chinese, which effectively fixes the skill to a specific language/locale. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.