Security audit

政府采购盲投参谋gov-blind-bid-advisor

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed procurement assistant, but its web collector can escape its stated host boundary through redirects and some reference docs describe broader external data lookups than the manifest grants.

Install only if you are comfortable reviewing a skill that performs live web collection and local bid-profile analysis. Before use, harden or require a fix for redirect validation in the collector, keep enterprise profiles and reports in a dedicated working directory, and do not rely on the broader WebFetch-based enterprise enrichment unless you explicitly approve those external lookups.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/collected_data.py:121
Finding: Outbound Host Allowlist Bypass Through Unvalidated HTTP Redirects
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/collected_data.py:46
Finding: Unpinned Third-Party Dependency Installation Guidance
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (23)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: 声明描述的是一个更完整的“盲投参谋”系统，核心包括上游商机发现/公告采集、中游匹配排序、下游投标决策，以及防御性文本风险扫描。实际代码仅覆盖其中一部分：基于已提供的结构化 JSON 输入做投标决策分析与报价建议。它没有采集公告、没有对候选项目做发现或排序、没有解析招标文件文本并扫描排他性条款或废标雷区，也没有知识库检索增强。虽然“资格/能力/利润/风险 go-no-go 结构化判断”这一子能力与代码较为吻合，但整体声明显著高于实际实现范围，因此属于描述与行为不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 该代码的核心功能是一个单一数据源的公告采集器，且强调 robots.txt、限速、白名单主机、防 SSRF、详情页字段抽取等采集实现细节。它确实符合声明中的“公开数据采集、纯本地、零 API Key”这一小部分，但没有实现声明里更核心的分析/决策能力：没有企业侧画像输入与匹配，没有排序推荐，没有投标资格与利润风险评估，也没有对公告文本做排他性条款、萝卜坑或废标风险审查。因此声明显著高于代码实际能力，属于实质性描述与行为不符。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill describes capabilities that imply network access, local file persistence, and reading auxiliary files, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authority ambiguity: a host may over-grant capabilities by default or users may not realize the skill needs network and file access. In a skill that scrapes external sites and persists enterprise data locally, unclear scope increases the chance of unintended data access or execution with broader privileges than necessary.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Overly broad trigger phrases can cause the skill to activate in adjacent or unintended conversations, pulling in a workflow that may invoke network collection, file reads, or procurement advice when the user did not clearly request it. In a skill that handles external data collection and local enterprise profiles, accidental activation can increase unnecessary data exposure and surprise tool use, even if the skill's stated purpose is benign.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The example headers hard-code Accept-Language: 'zh-CN,zh;q=0.9,en;q=0.8', which imposes a specific locale preference. Under the policy, locale constraints should be user-selectable or clearly justified as region-specific; this document does not explicitly present it as an opt-in or mandatory regional compliance requirement.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: Lines L003-L005 explicitly state that bidder-to-bidder collusion/bid-rigging detection is not implemented or used because the skill lacks access to others' data and such signals could be misused. However, later strategy examples rely on competitor_prices and recommend pricing relative to competitors and historical discounts (L326-L354), which contradicts the stated restraint against using other bidders' data/signals in this skill's reference material.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file directs collection of enterprise, litigation, and administrative-penalty data via WebFetch from external sites but provides no notice about what data leaves the local environment, what is fetched remotely, or what legal basis and minimization rules apply. In a procurement context, this can cause inadvertent transmission or aggregation of sensitive company/personally identifying data and create privacy, compliance, and confidentiality risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The parameter description explicitly says the query must be in Chinese natural language. Under the policy, forcing a specific language is a violation unless the skill offers user opt-in or clearly documents and justifies the locale restriction. This file does not provide such an opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file title and the entire document are written in Chinese, and there is no accompanying note offering alternative languages or stating that the skill is region/language-specific. Under the policy rule for language/locale, natural-language instructions that effectively force a language without user opt-in should be flagged unless the constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Lines L004-L007 state that www.ccgp.gov.cn is the unique data source and that all other platform listings are only background reference, not actual integrations. However, L146-L150 define a general data-source priority including official APIs, WebFetch, and Playwright, and earlier sections L025-L037 and L104-L121 describe other national and sector platforms in operational terms, creating a direct documentation-level contradiction about actual intended sources.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest content is entirely in Chinese, including the title and full_text, with no indication that language selection is optional or that the skill is limited to a Chinese-speaking or China-specific deployment context. Under the stated policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The JSON content is entirely in Chinese, including project descriptors, rule names, messages, snippets, and hints, with no indication that language selection is optional or that the file is intentionally limited to a Chinese-only workflow. Under the stated policy, forcing a specific language or locale without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains user-facing natural-language instructions and descriptions that assume a single language/locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file embeds all user-facing documentation and CLI descriptions in Chinese, and the generated report and console output are also fixed in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This Python skill includes its top-level description, CLI help text, warnings, and generated report content entirely in Chinese. Because the file provides no opt-in, fallback, or documented locale constraint, it effectively forces a specific language on users, which matches the natural-language locale policy violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains user-facing natural language only in Chinese, which can amount to a language/locale policy violation when no opt-in or alternative language choice is provided. The file does not state that it is intended exclusively for a Chinese-speaking or region-specific audience, so the language constraint is undocumented.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The entire skill description, examples, and user interaction guidance are written exclusively in Chinese, with no indication that users may choose another language or locale. Under the policy rule for natural-language violations, this can be treated as a language constraint imposed without explicit user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The entire skill file is written in Chinese and provides no indication that language selection is optional or user-configurable. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The display name and description are entirely in Chinese, and the manifest does not state that the skill is China-specific or offer any language/locale choice. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file contains user-facing natural language solely in Chinese, and there is no indication that the user can choose another language or that the report is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The document presents all user-facing instructions and policy guidance exclusively in Chinese. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This JSON manifest-like file presents platform metadata and the compliance note entirely in Chinese, with no indication that language selection is optional or constrained to a justified region-specific use case. Under the natural-language policy rule, a fixed locale can be a policy violation when the file does not offer user opt-in or explicitly document the locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The request session sets Accept-Language to zh-CN,zh;q=0.9,en;q=0.8, which imposes a specific locale preference by default. The file does not offer the user a language/locale choice or document this as a justified region-specific requirement.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.