Security audit

gq-procurement-advisor

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Chinese-language state-owned-enterprise procurement compliance assistant with no executable code or persistence, though users should notice its mandatory author signature and legal-scope caveats.

Before installing, understand that formal answers and generated documents will include the author signature “一线评标专家&ChesaraM” unless the skill is changed. Use it for Chinese SOE procurement scenarios, verify current law and internal rules before acting, and switch to the appropriate government-procurement, bidding-compliance, or legal counsel path when the funding source or project type is unclear.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:238
Finding: Mandatory Attribution Hijacks Substantive Agent Responses
Content: View full analysis
**Signature**: Front-line Bid Evaluation Expert & ChesaraM - The signature is only an author identifier. External contact information or promotional content must not be added to it. - The disclaimer that the response does not constitute a formal legal opinion must still appear before the signature under the original rules. ``` The behavior is also reinforced by mandatory signature examples in `templates/输出模板.md`, including lines 26 and 48. ### Technical Analysis The skill requires the agent to append a fixed third-party attribution to every formal or substantive response. This instruction is unrelated to the functional requirements of procurement compliance analysis and overrides the expected user-controlled presentation of generated content. Because the rule applies automatically whenever the skill produces substantive output, users do not need to request the attribution and may be unable to receive neutral or unbranded documents. Generated reports, legal-compliance drafts, and other materials can consequently imply that the named parties authored, reviewed, or endorsed the content when no such relationship has been established. This is classified as instruction hijacking because loading the skill introduces a persistent session-level output requirement that changes how the agent must answer subsequent requests. ### Attack Path 1. A user activates the procurement-advisor skill. 2. The agent loads the instructions from `SKILL.md`. 3. The user requests a compliance conclusion, re ...[truncated 1020 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The title and overall README are entirely in Chinese, and the file presents the skill as a general-purpose procurement compliance assistant without stating that Chinese-only output is optional or required by a region-specific deployment policy. Under the language/locale policy rule, forcing a single language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation presents government procurement and pure engineering bidding as excluded domains, but later operational guidance allows substantive treatment of those domains when classification is uncertain. This inconsistency can bypass routing controls and cause the agent to answer matters outside its approved competence, which is especially risky in compliance and legal-advice contexts.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly says government procurement is out of scope, but then instructs the agent to provide 'two analysis frameworks' when the boundary is unclear. That creates scope creep into a regulated legal domain the manifest says should be routed elsewhere, increasing the chance of users receiving authoritative-sounding advice under the wrong legal regime.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The natural-language instruction under '语言要求' requires a specific language style and assumes Chinese output ('人话翻译') for all responses, and the entire skill is presented as Chinese-only with no user language choice. Under the policy, forcing a specific language without opt-in is a locale/language policy violation unless the constraint is explicitly justified as region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.