Security audit

标事通标书智能写作

Security checks for vulnerabilities and agentic risk

Overview

The skill largely does what it says, but it has review-worthy issues around overbroad response-control instructions, hidden local metadata persistence, and API-key handling risks.

Install only if you are comfortable sending authorized tender or bid documents to the 百炼标书 service and having results tied to that account. Before use, confirm upload consent, write the API key directly into the skill-local config.json rather than using a command-line --app-key, and be aware that the client may leave tender filename/job metadata in ~/.zcm/projects.json unless ZCM_HOME is set. Also review the fixed referral/channel messaging and paid-operation flow before adopting it in a neutral or enterprise environment.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:142
Finding: Mandatory Promotional Output and Agent Instruction-Priority Hijacking
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/zcm_lib/storage.py:62
Finding: Undeclared Persistent Metadata Storage Outside the Declared Filesystem Boundary
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/zcm_lib/http_client.py:38
Finding: API Credential Can Be Forwarded During Cross-Origin HTTP Redirects
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/zcm_lib/parser.py:29
Finding: Sensitive API Key Accepted Through a Command-Line Argument
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/zcm_lib/cli.py:537
Finding: Compliance Upload Lacks Document-Count and Aggregate-Size Enforcement
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (33)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
**升级 skill 必须保留配置**：如果当前已安装目录存在 `config.json`，升级时不得删除、覆盖或替换该文件；只能更新 `SKILL.md`、`scripts/`、`references/` 等 skill 内容文件。本地生成目录 `biaoshu-bailian-files/` 也必须保留。

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow explicitly supports uploading bid documents or passing external file URLs, which are likely to contain sensitive commercial, pricing, and qualification data, but it provides no privacy notice, data-handling warning, or trust-boundary guidance. This can cause users or downstream skill implementations to transmit confidential procurement materials to third-party infrastructure without informed consent or safeguards.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file contains all user-facing instructions and API guidance exclusively in Chinese, and there is no indication that users may choose another language or that the skill is limited to a Chinese-only audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The entire skill file is written only in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-language or region-specific compliance context. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The documentation explicitly states that uploaded files and task results are retained on the vendor's servers for about 7 days, but frames this as an operational detail rather than a privacy/security warning or consent requirement. Because this API handles bid/tender documents that may contain confidential business information, lack of prominent disclosure and handling guidance can lead users or downstream agents to transmit sensitive data without understanding the retention, storage, and third-party exposure implications.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The instruction says the script output and report '已自动转中文' and to '直接用中文呈现', which mandates a specific language for user-facing output. This is a locale/language policy issue because the file does not indicate user choice or opt-in for Chinese output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This file contains hard-coded natural-language messages in Chinese, including the validation error at L18, and the CLI description/help text also remains Chinese-only. Because the skill does not offer a language/locale choice or document that it is intentionally region-specific, it appears to enforce a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The generated HTML hard-codes lang='zh-CN', which imposes a specific language/locale on all rendered reports. The file also contains multiple fixed Chinese UI strings, and there is no visible option for users to select another locale or any documented reason this must be China-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The function returns user-facing status text entirely in Chinese (e.g. '预计/本次需要约' and '当前可用') with no indication that language is configurable or chosen by the user. This creates a locale/language policy issue because the skill appears to enforce a specific language in its natural-language output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The string literal "请求失败 HTTP ..." forces Chinese output for an end-user-visible error path. There is no indication in this file that the skill is region-specific or that users can opt into their preferred language, which conflicts with the language/locale policy requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code emits multiple user-facing status and error messages in Chinese, beginning in the polling path and continuing throughout the file. That enforces a specific language on all users with no opt-in or documented region-specific justification, which matches the natural-language locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The download-link and progress-reporting paths present all user-visible guidance in Chinese only, including operational instructions and warnings. Because the file does not offer any language/locale choice or justify a Chinese-only constraint, this is a policy-level language restriction.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · scripts/zcm_lib/parser.py (reported line 13)May include surrounding context.
python
contract_snapshot, funcs, description, include_skillhub_auth=False, allow_remote_files=False, include_feedback=False, ):

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This helper formats user-facing durations entirely in Chinese (for example, 分钟, 小时, 天) with no apparent language selection or opt-in. The same pattern continues in later user-visible status strings, which indicates the skill forces a locale rather than offering a user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The function constructs progress updates such as 处理中, 任务已完成, and 进度更新 entirely in Chinese. Because no language/locale option or documented justification is present in this file, this appears to violate the policy against forcing a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The function emits a fixed Chinese reminder string, and the file also contains multiple hard-coded Chinese user-facing status messages. This enforces a specific language/locale in user-visible output without any visible option to choose another language or explicit justification for a locale restriction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This code writes credential data to a persistent local config.json file, which is a safety-relevant file write involving sensitive data. Although the docstring describes the action for developers, there is no user-facing confirmation, warning, or visible disclosure in this file that credentials will be stored on disk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The instruction to always present wallet_balance to users as the Chinese term “可用字数” imposes a specific language/locale in user-facing output. The file does not indicate that users may choose another language or that this locale restriction is optional or region-justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: All user-facing natural-language instructions in this file are Chinese, with no indication that the skill supports other languages or that Chinese is a justified locale constraint. Under the policy, forcing a specific language without user opt-in can be a natural-language policy issue unless clearly documented as region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation instructs the skill to download generated bid documents to the local system on user request, but it does not warn about local file writes, destination selection, or the sensitivity of the resulting files. This increases the chance of confidential bid materials being stored in insecure locations or written automatically without adequate user awareness.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: Line L69 explicitly instructs consumers that if semantic review is incomplete, they must say the result is partial and must not present it as a complete review. However, the surrounding result schema at L42-L55 presents the same compliance result structure regardless of completion state, creating an intent/usage divergence risk in the documentation itself: consumers could treat status: completed plus summaries/issues as a full review unless they also inspect the semantic-review indicators.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code hardcodes Chinese report titles and labels such as "招标文件智能解读报告" and mixed Chinese section text, which means generated reports are effectively constrained to a specific language/locale. The file does not show any user-selectable language option or justification for enforcing Chinese output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The compliance renderer uses fixed Chinese report names and labels, including "合规审查报告" and Chinese cover metadata. Under the policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This renderer produces Chinese-language report titles, labels, and explanatory text such as "标书查重报告" and the Chinese legal disclaimer. The file provides no evidence of an explicit language choice or documented reason for restricting output to Chinese.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The only natural-language description in this file is written entirely in Chinese, which may imply a language-specific interface or documentation without offering any language choice. Under the policy rules, language constraints should be opt-in or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/zcm_lib/reporting.py:59