百炼标书智能写作工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:04 AM UTC
• Version: 1.0.17

Overview

The skill largely does what it says, but it needs Review because it handles sensitive bid files and credentials while allowing uncontained file writes, undeclared local metadata persistence, and risky API-key redirect behavior.

Install only if you are comfortable uploading confidential tender/bid files to the 百炼标书 service, using a full-account API key, and accepting possible word-balance charges. Prefer a dedicated output folder, avoid user-controlled report basenames or arbitrary save paths, and clear ~/.zcm/projects.json if you do not want tender/job metadata retained across sessions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:64

Finding

Mandatory Promotional Output and Response-Priority Hijacking

Content

View full analysis

本报告由「百炼®标书」skill 自动生成" f"百炼®标书 · {esc(self.title)}") ``` ### Technical Analysis The Skill declares its own user-output rules to have the highest priority and to override other content. It then requires the agent to reproduce extensive API-key acquisition instructions, product descriptions, usage examples, referral-bearing URLs such as `?ch=c666`, and platform branding. A Skill may define operational guidance, but it should not attempt to elevate marketing or referral requirements above the agent's normal response goals. The instructions affect unrelated introduction, help, setup, and result-delivery responses rather than limiting themselves to security-critical disclosures. The generated reports also receive mandatory branding regardless of whether the user requested a branded artifact. ### Attack Path 1. The agent loads `SKILL.md` ...[truncated 837 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/zcm_lib/storage.py:61

Finding

Undeclared Persistent Project Metadata Outside the Permitted Storage Boundary

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/report_lib/generator.py:20

Finding

Arbitrary File Write Through Unrestricted Output Paths and Basename Traversal

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/zcm_lib/http_client.py:38

Finding

API Credential Exposure Through Unrestricted Cross-Origin Redirects

Content

View full analysis

Remediation

View remediation

other

Note

• Location: SKILL.md:92

Finding

Documentation Loads Images From an Undeclared External Domain

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (26)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md

**升级 skill 必须保留配置**：如果当前已安装目录存在 `config.json`，升级时不得删除、覆盖或替换该文件；只能更新 `SKILL.md`、`scripts/`、`references/` 等 skill 内容文件。本地生成目录 `biaoshu-bailian-files/` 也必须保留。

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file contains all user-facing operational instructions in Chinese and does not indicate that the skill supports other languages or that Chinese is a required locale. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file presents all user-facing instructions and API usage details exclusively in Chinese. The policy requires avoiding forced language or locale constraints unless the skill offers opt-in language choice or clearly documents that the skill is region-specific and why.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file presents all instructions, parameters, and error-handling guidance only in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document explicitly states that uploaded files and task results are retained on the vendor's servers and tied to the API key owner's account, but it does not pair that with a clear privacy/security warning or guidance on handling sensitive bid documents. In this context, the files are likely to contain confidential commercial or regulated data, so omission of an explicit retention/privacy caution can lead users to upload sensitive material without informed consent or proper controls.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The entire skill guidance is written only in Chinese and instructs assistant behavior in that language context, but it does not state that the skill is region-specific or provide any opt-in/alternative language handling. Under the language/locale policy, forcing a specific language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instruction says script output and reports have already been automatically converted to Chinese and should be presented directly in Chinese. This imposes a language choice on the user without offering any locale or language opt-in, which matches the policy's language/locale violation criterion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The exception message at this line is hard-coded in Chinese, and the CLI help text elsewhere in the file is also exclusively Chinese. This imposes a specific language on users without opt-in or documented locale justification, which matches the natural-language policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The command-line description and argument help strings are written only in Chinese, which forces a specific language experience on users. The file does not offer a language choice or explain that the tool is intentionally limited to a Chinese-language context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code emits report titles and labels in Chinese (with some bilingual headings) as fixed natural-language output, and the rest of the file continues that pattern across all report sections. Because there is no user opt-in, locale selection, or documented region-specific justification in this file, it appears to enforce a specific language/locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The rendered HTML always sets lang='zh-CN', which forces a specific locale for all generated reports. This is a natural-language policy concern because the file does not offer user opt-in or an alternative locale, and the code is not clearly documented as region-specific only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The user-facing strings returned by shortage_detail are hardcoded in Chinese, which imposes a specific language on all users. The file contains no indication of locale selection, user opt-in, or documentation justifying a China-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code emits user-facing error text in Chinese in a shared helper, which forces a specific language/locale on all users of the skill. The file does not provide any opt-in, fallback, or documented justification for a Chinese-only locale, which matches the natural-language policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The error output includes Chinese text such as "请求失败 HTTP" and "message:"/hint formatting, which imposes a specific language for user-visible messaging. There is no indication in this file that users can choose their preferred language or that the locale restriction is documented as intentional and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code emits multiple natural-language status and error messages in Chinese, starting here and continuing throughout the file. Because the file forces a specific language for user-facing output without any opt-in or documented regional justification, it violates the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/zcm_lib/parser.py (reported line 13)May include surrounding context.

python

contract_snapshot,
    funcs,
    description,
    include_skillhub_auth=False,
    allow_remote_files=False,
    include_feedback=False,
):

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The formatting helpers return Chinese-language strings such as '分钟', '小时', and '天' directly. This imposes a specific language on all users of the skill with no indication of locale selection or documented regional scope, matching the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The function constructs all status and progress text in Chinese, including queueing, success, failure, and background-listening messages. Because the file provides no user choice or documented region-specific justification, this is a natural-language locale policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module hardcodes Chinese translations for risk and priority enums and later emits Chinese user-facing messages, which imposes a specific language/locale by default. The file does not offer any mechanism for user selection or documented justification for this locale restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The billing section says generation does not perform a low-balance warning or balance interception before execution, but it does not elevate this into a clear user-facing caution that billable actions may still proceed and consume quota unexpectedly. This creates a risk of surprise charges or unintended quota depletion, especially in automated agent workflows that may trigger expensive operations without interactive confirmation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code hard-codes user-facing Chinese labels across multiple constants and status mappings, and the comment at L045-L046 states report artifacts currently ship with zh-CN labels. That is a natural-language locale constraint, and there is no indication in this file that users can choose another language or explicitly opt in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code creates HTML and DOCX files on disk via file writes, but there is no confirmation prompt, warning comment/docstring, or user-facing log message describing that report artifacts will be written to the specified output directory. Because file writes are a safety-relevant operation under this rubric, the lack of disclosure is a qualifying issue in this code file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The only user-facing natural-language description in this file is entirely in Chinese, describing the CLI entrypoint and compatibility behavior. This can indicate a language-specific constraint without offering any user choice or documenting that the tool is region-specific, which matches the locale-policy concern in scope.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/zcm.py (reported line 10)May include surrounding context.

python

from zcm_lib import cli as _cli

globals().update({name: getattr(_cli, name) for name in dir(_cli) if not name.startswith("__")})


if __name__ == "__main__":

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This code sends network requests and may include caller-supplied headers, raw data, or JSON bodies, but the function itself provides no confirmation prompt or user-facing notice that data is being transmitted. The docstring is technical and does not warn users about outbound network activity or possible transmission of user/system data.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/zcm_lib/reporting.py:59