Security audit

全行业标书智能生成助手 | 商务标

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent bid-document workflow, but it handles sensitive files and credentials while showing several review-worthy scoping and safety gaps.

Review before installing. Only use it for tender/bid documents you are allowed to upload to the 百炼标书 service, confirm uploads and any paid generation/review/checking action first, keep the API key out of chat, and avoid custom output paths or basenames until path containment and overwrite behavior are fixed. The publisher should also remove priority-override/promotional mandates, enforce same-origin redirects, and document or relocate the ~/.zcm metadata file.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:63
Finding: Mandatory Promotional Output and Skill Instruction-Priority Override
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/zcm_lib/http_client.py:40
Finding: API Credential May Be Forwarded During Cross-Origin HTTP Redirects
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/zcm_lib/storage.py:62
Finding: Project Metadata Is Persisted Outside the Declared Filesystem Boundary
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/report_lib/generator.py:13
Finding: Unrestricted Output Paths and Unsanitized Report Basenames Permit Arbitrary File Overwrite
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (28)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
**升级 skill 必须保留配置**：如果当前已安装目录存在 `config.json`，升级时不得删除、覆盖或替换该文件；只能更新 `SKILL.md`、`scripts/`、`references/` 等 skill 内容文件。本地生成目录 `biaoshu-bailian-files/` 也必须保留。

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill advertises activation on very broad, everyday bidding-related phrases, which can cause unintended invocation when a user is only asking general questions. In this skill's context, unintended invocation is more dangerous because it handles sensitive tender/bid documents, writes local files, performs network uploads to a third-party service, and may trigger billable operations once a workflow proceeds.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire skill reference is written in Chinese and includes mandatory phrasing instructions such as '展示给用户时统一说“可用字数”' and '必须把 ... 转述给用户', which prescribe a single language/locale for user-facing communication. There is no indication that the user can choose another language or that this locale restriction is optional or justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file contains user-facing instructions and API workflow guidance exclusively in Chinese. Under the policy, forcing a specific language without user opt-in or a clearly documented locale-specific justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: L149 states that script output and reports are automatically converted to Chinese and should be presented directly in Chinese. This imposes a language choice on the user without any opt-in or documented locale limitation, which matches the language/locale policy violation criterion.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Natural-language strings in the exception and command-line help are presented only in Chinese, which imposes a fixed language on users without opt-in or configuration. Under the policy, language constraints should either be optional or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The parser description and argument help strings are all written in Chinese, which enforces a specific language for the user interface. There is no indication that users can choose another language or that the locale restriction is intentionally documented.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code hard-codes the generated HTML document language to zh-CN, which enforces a specific locale for all rendered reports. Under the stated policy, forcing a language/locale without user opt-in or clear region-specific justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The error strings shown to users are hard-coded in Chinese, and the file provides no indication that the skill is intended only for Chinese-speaking users or offers any locale selection. This creates a natural-language policy issue because the skill imposes a specific language on all users without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This validation failure message is presented only in Chinese, with no mechanism in the file for language choice or fallback. Absent documentation that the skill is region-specific, this violates the requirement not to force a specific language on users.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file-not-found error string is user-facing and forces Chinese output for all users. The file does not offer language choice or note that the skill is limited to a Chinese-language environment, so this is a policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The error message string 请求失败 HTTP ... is hard-coded in Chinese, which imposes a specific language on users. The provided file does not show any language selection, opt-in, or documented region-specific constraint that would justify this locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Multiple user-visible strings printed or passed to logging functions are exclusively in Chinese, such as status, timeout, failure, and save-path guidance messages. This forces a specific language for interaction without offering the user any locale choice or documenting a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · scripts/zcm_lib/parser.py (reported line 13)May include surrounding context.
python
contract_snapshot, funcs, description, include_skillhub_auth=False, allow_remote_files=False, include_feedback=False, ):

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The version string and subsequent CLI help text are written exclusively in Chinese, which imposes a specific language on all users of this parser. The file does not present any opt-in, language selection mechanism, or documented region-specific justification, so this is a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code formats user-facing progress and duration text exclusively in Chinese, including phrases like “分钟”, “小时”, and other Chinese status messages later in the file. The file provides no language-selection mechanism or documented locale constraint, so it appears to force a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The function constructs all progress updates in Chinese, such as “任务已提交，正在排队”, “任务已完成”, and “进度更新：...”, and does not expose any option for alternate languages. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The platform reminder string is hard-coded in Chinese, and the module also translates output labels to Chinese by default. This imposes a specific language on users without any opt-in, fallback, or documented region-specific constraint, which matches the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation at L135 states that before generation there is no insufficient-balance warning and no balance-based blocking, but L161 says the script pre-checks available balance before submission. Those statements create an intent/documentation contradiction about whether balance is checked proactively. This is a documentation-level divergence that could mislead users about cost-related behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file contains user-facing instructions and API documentation exclusively in Chinese, and nowhere indicates that users may choose another language or locale. Under the policy criteria, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The document presents the feature as being used to start a bid compliance review, but it explicitly states that invoking it consumes available quota and may fail for insufficient balance. This is an intent-level divergence in the documentation because the operation is not merely analytical; it also has an account-billing effect that is materially relevant to user intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file documents that report artifacts ship with zh-CN labels, and the code consistently maps output labels to Chinese-only strings. This is a natural-language locale constraint that does not offer users a language choice or opt-in, which can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code creates output files in the selected directory by writing HTML and DOCX reports, which is a safety-relevant file modification operation. In this file there is no confirmation prompt, warning message, or explanatory comment/docstring disclosing that report generation will create or overwrite files on disk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The only natural-language description in the file is written in Chinese and does not indicate that language selection is optional or region-specific. Under the language/locale policy rule, this can be interpreted as imposing a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Confidence: 50% confidence
Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
Content: Scanner excerpt · scripts/zcm.py (reported line 10)May include surrounding context.
python
from zcm_lib import cli as _cli globals().update({name: getattr(_cli, name) for name in dir(_cli) if not name.startswith("__")}) if __name__ == "__main__":

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/zcm_lib/reporting.py:59