T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:141- Finding
Mandatory Branded and Referral Output Through Priority Instruction Overrides
- Content
View full analysis
- Remediation
View remediation
Security audit
全行业标书智能检查助手
Security checks for vulnerabilities and agentic risk
Overview
The skill largely matches its stated bid-document workflow, but it needs review because it handles sensitive paid-account documents and keeps local project metadata outside its declared storage boundary.
Review before installing if your tender or bid files are confidential. The skill uploads documents to biaoshu.zhiliaobiaoxun.com under your API key and may consume paid word balance; only use it with files you are authorized to process. Also note that it stores project/job-to-filename metadata in ~/.zcm/projects.json by default, outside the declared output directory, and includes mandatory referral-style platform links in its user guidance.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/zcm_lib/storage.py:62- Finding
Persistent State Written Outside the Declared Filesystem Boundary
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (29)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md **升级 skill 必须保留配置**：如果当前已安装目录存在 `config.json`，升级时不得删除、覆盖或替换该文件；只能更新 `SKILL.md`、`scripts/`、`references/` 等 skill 内容文件。本地生成目录 `biaoshu-bailian-files/` 也必须保留。
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The document title and all operational instructions are written exclusively in Chinese, and line L27 explicitly prescribes the exact user-facing wording to use. There is no indication that users may choose another language or locale, which can violate a language/locale policy requiring user choice or opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file presents all user-facing instructions and operational guidance exclusively in Chinese. Under the policy rule, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill specification is written exclusively in Chinese and does not indicate that users may choose another language or locale. Under the policy, a language/locale constraint should either be optional or clearly documented as a justified region-specific limitation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The document explicitly states that uploaded files and task results are retained on the provider's servers for about 7 days, but it does not pair that with any user-facing privacy warning, consent guidance, or data-handling precautions. In a bid/tender workflow, uploaded documents may contain confidential commercial, personal, or regulated information, so omission of retention and privacy guidance can lead to unintended sensitive-data exposure and compliance risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The entire skill document is written only in Chinese and provides no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The instruction says script output and reports have '已自动转中文' and should be presented directly in Chinese. This imposes a language choice on the user without offering an opt-in or alternative locale, which is a natural-language policy violation under the language/locale rule.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The generated HTML sets
lang='zh-CN', which enforces a specific locale in the output. The file also contains multiple hard-coded Chinese UI strings throughout the rendering path, and there is no visible option for users to select another language or locale.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The error message text is hardcoded in Chinese (for example, '请求失败'), which imposes a specific language on users without any opt-in, fallback, or documented locale constraint. This is a natural-language policy issue because the file contains user-visible strings that force a locale rather than offering language choice or documenting a justified region-specific scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code emits multiple natural-language user-facing messages in Chinese, such as terminal error and timeout text, with no indication that the user can opt into another language. The policy explicitly flags locale/language constraints when a skill forces a specific language without user choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Several command handlers and progress-stream outputs print Chinese-only status, warning, failure, and guidance messages directly to users. Because the file provides no language selection mechanism or documented locale restriction, this is a natural-language policy violation under the stated rules.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
python contract_snapshot, funcs, description, include_skillhub_auth=False, allow_remote_files=False, include_feedback=False, ):
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The parser defines version text, command help, and argument help strings in Chinese throughout the CLI, which imposes a specific language on all users. There is no visible option to select another language or opt into this locale, so this appears to violate the language/locale policy for natural-language content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The formatting helpers return Chinese-only time/unit strings such as "分钟", "小时", and "天", and later functions also assemble fully Chinese status messages. This creates a language/locale policy issue because the skill output is forced into a specific language with no apparent user choice or documented locale constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The main progress-line formatter builds all user-visible messages in Chinese, including queueing, success, failure, and background-listening notices. Because there is no visible mechanism for language selection or opt-in, this is a natural-language policy violation under the locale/language rule.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file hard-codes Chinese translations for risk and priority labels, and later emits Chinese user-facing log messages. This imposes a specific language on users with no visible option to select another locale, which matches the natural-language locale policy violation criteria.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
This file is documentation-only, so the only applicable mismatch class is internal intent divergence in the docs themselves. L69 explicitly instructs consumers not to present incomplete semantic review results as complete, yet the example result above shows a generic
status: "completed"without any emphasized guardrail in the schema itself, creating a contradictory signal about review completeness.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This file presents all operational instructions in Chinese only, and there is no indication that the skill is region-specific, Chinese-only by design, or that users may opt into another language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The module docstring is written entirely in Chinese and presents the skill behavior only in that language. Under the language/locale policy rule, this can be a natural-language policy issue because it imposes a specific language without showing any user choice or documented justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The raised error message is hardcoded in Chinese, which imposes a specific language on users without any opt-in or locale selection. This is a natural-language policy concern because the file does not offer an alternative language or document that the tool is intentionally Chinese-only.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This code writes generated HTML and DOCX reports to the filesystem, but there is no confirmation prompt, warning comment, or user-facing disclosure near the write operations themselves. Although output generation is the function's purpose, the file creation behavior is not explicitly disclosed at the point of execution beyond argument names.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The command-line description and argument help strings are all written in Chinese, forcing a single language experience without opt-in. There is no indication in this file that the tool is region-specific or that users can select their preferred language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This file contains user-facing natural-language documentation that forces a specific language/locale context without any opt-in or alternative. The stated policy flags language-only behavior when no user choice is offered.
- Content
Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Confidence
- 50% confidence
- Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
- Content
python from zcm_lib import cli as _cli globals().update({name: getattr(_cli, name) for name in dir(_cli) if not name.startswith("__")}) if __name__ == "__main__":
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The helper returns fixed Chinese-language messages (e.g. '预计/本次需要约' and '当前可用') with no indication that the user can choose another language. This can violate language/locale policy when the skill is expected to operate in a general context rather than a documented Chinese-only workflow.
- Content
Static analysis
Detected: suspicious.dynamic_code_execution
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- scripts/zcm_lib/reporting.py:59