Security audit

政采质疑函与投诉书智能起草助手Gov Procurement Challenge Drafter

Security checks for vulnerabilities and agentic risk

Overview

This is a narrowly scoped Chinese government procurement challenge and complaint drafting skill with disclosed legal-use boundaries and no executable or persistent behavior.

Before installing, treat the skill as an AI drafting assistant for Chinese government procurement challenge letters and complaints, not as a lawyer. Review generated legal citations, dates, evidence references, and local finance-authority practice before filing, and avoid using it for procurement contract disputes or tender-bidding-law matters outside its stated scope.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The prohibition section says the skill must not review procurement contracts or handle non-challenge legal documents, but elsewhere the documentation supports contract-related classification/handling. This inconsistency creates an exploitable policy gap: users can phrase contract disputes in mapped terms and induce the skill to provide assistance outside its authorized legal domain.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill’s tag mapping includes '履约验收 + 采购合同' for user inputs about acceptance failures or non-payment, which expands the assistant into contract-performance matters that the manifest and boundary section explicitly prohibit. This can cause the router or downstream logic to engage the skill for out-of-scope legal topics, leading to unauthorized legal drafting/advice and increased risk of inaccurate or noncompliant guidance.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The manifest presents the skill entirely in Chinese, including the main description of the assistant's behavior, and does not indicate that users may choose another language. Under the policy, language constraints should be opt-in or clearly justified as region-specific; here the procurement domain is Chinese, but the manifest does not explicitly document a language/locale limitation or offer alternatives.

Static analysis

No suspicious patterns detected.