Security audit

投标文件自动生成

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly fits its bid-document cloud-processing purpose, but it includes mandatory referral-style output rules and writes persistent project metadata outside its declared write area.

Review before installing. Use it only for tender or bid documents you are authorized to upload to the vendor service, expect account-based storage and possible billing, keep the API key out of chat, and be aware that the skill may create ~/.zcm/projects.json unless ZCM_HOME is controlled or the file is later cleaned up.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:64
Finding: Mandatory Promotional Output and Referral-Link Injection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/zcm_lib/storage.py:62
Finding: Persistent Metadata Written Outside the Declared Filesystem Boundary
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/zcm_lib/files.py:48
Finding: Compliance Uploads Can Exhaust Memory Due to Fully Buffered Multipart Encoding
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (35)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
**升级 skill 必须保留配置**：如果当前已安装目录存在 `config.json`，升级时不得删除、覆盖或替换该文件；只能更新 `SKILL.md`、`scripts/`、`references/` 等 skill 内容文件。本地生成目录 `biaoshu-bailian-files/` 也必须保留。

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The instruction '展示给用户时统一说“可用字数”' mandates a specific Chinese phrasing for user-facing output. This is a language/locale constraint presented as a blanket requirement, with no indication that the user can choose another language or locale.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The API accepts sensitive bid documents either as direct uploads or by fetching them from an external URL, but the documentation provides no privacy, retention, access-control, or third-party fetch warning. Bid/tender files commonly contain confidential commercial and personal data, so silent ingestion or server-side retrieval can expose users to unintended data disclosure and SSRF-style risk if arbitrary URLs are fetched by the backend.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains user-facing instructions only in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking/regional audience. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document states that uploaded files and task results are retained on the vendor server and tied to the API key owner account, but it does not prominently warn users about privacy, confidentiality, retention period implications, or suitability for sensitive bid/procurement documents before use. Because this skill handles potentially sensitive business documents, unclear disclosure can lead to unintended third-party storage of confidential materials and compliance/privacy exposure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The entire skill reference is written only in Chinese and provides operational guidance exclusively in that language. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified, which is not stated here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: Line L149 states that script output and reports have already been converted to Chinese and should be presented directly in Chinese. This imposes a specific language on users without opt-in or an explicit locale limitation, which matches the language/locale policy-violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The exception message is hard-coded in Chinese, which imposes a specific language on users without any opt-in or fallback. This is a natural-language policy concern because the file provides user-visible text but does not offer locale selection.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The argparse description and help strings are all presented in Chinese, which forces a specific language for command-line users. There is no indication of user choice, fallback, or documented locale restriction to justify this constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code hard-codes Chinese titles and labels for generated reports, such as "招标文件智能解读报告" and Chinese field names, which constrains the output language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The compliance renderer constructs report content using fixed Chinese headings and labels, including the report title and cover metadata. This enforces a specific language for user-facing output without any visible opt-in or locale-selection mechanism.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This renderer generates user-facing report titles, labels, and explanatory text in Chinese by default. Because no language choice or explicit locale constraint is shown, it appears to force a specific language in violation of the stated policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code embeds Chinese-only user-facing text and locale assumptions, beginning with the docstring and continuing throughout the generated HTML/DOCX output. The file does not offer a language choice or indicate that the skill is intentionally region-specific, which can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The rendered HTML sets lang='zh-CN' unconditionally, which forces a specific locale for all users and outputs. Under the stated policy, locale constraints should be optional or explicitly justified rather than silently imposed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The error strings in these lines are hard-coded in Chinese, which imposes a specific language on users. The file does not indicate that the skill is China-specific or that users can opt into this locale, so this is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This line emits a Chinese-only error message to users. Without an explicit user language choice or documented regional scope, this violates the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code presents a Chinese-only runtime error string. Because no locale selection or region-specific justification is present in this file, the message can conflict with organizational language policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The string literal 请求失败 HTTP ... hard-codes Chinese for a user-facing error message. This imposes a specific language without opt-in or documented locale justification, which is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code emits user-facing status and error text in Chinese, including timeout and failure guidance, and the pattern continues throughout the file. Because the skill does not offer any language opt-in or locale selection, it appears to enforce a specific language, which matches the natural-language locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The download-link flow presents all user-visible guidance in Chinese, including warnings and next-step instructions. This is a policy issue because the skill forces one language rather than offering a choice or documenting a justified regional limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The result fallback path and progress-stream output use Chinese-only messaging for operational guidance and status updates. Without opt-in, fallback, or documented regional scoping, this violates the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · scripts/zcm_lib/parser.py (reported line 13)May include surrounding context.
python
contract_snapshot, funcs, description, include_skillhub_auth=False, allow_remote_files=False, include_feedback=False, ):

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The formatting helpers return Chinese-only strings such as '分钟', '小时', and '天', and the main progress formatter also emits Chinese-only status text. This forces a specific language in user-facing output without opt-in or any documented justification, which matches the locale-policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file defines Chinese-only translations for result enums and uses Chinese user-facing messages throughout, which imposes a specific language/locale on users. There is no indication in this file that users can choose another language or that the locale restriction is documented as an explicit, justified constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The platform reminder and balance-reporting messages are emitted only in Chinese, and the file provides no alternative locale path or opt-in. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless clearly documented and justified.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/zcm_lib/reporting.py:59