Security audit

投标文件写作专家

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it advertises, but it deserves review because it uploads sensitive bid documents to a paid cloud service while forcing channel-tagged platform links and using weak API-key redirect safeguards.

Install only if you are comfortable sending tender and bid documents to biaoshu.zhiliaobiaoxun.com, storing an account API key in the skill directory, and accepting platform billing for generation/review/checking. Treat ?ch=c666 links as channel-tagged platform links, confirm before uploads or paid actions, and rotate the API key if you suspect any redirect or credential exposure.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:142
Finding: Mandatory Commercial Promotion and Referral-Link Injection into Agent Responses
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/zcm_lib/http_client.py:40
Finding: API Credential Can Be Forwarded During Unvalidated Cross-Origin Redirects
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (37)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
**升级 skill 必须保留配置**：如果当前已安装目录存在 `config.json`，升级时不得删除、覆盖或替换该文件；只能更新 `SKILL.md`、`scripts/`、`references/` 等 skill 内容文件。本地生成目录 `biaoshu-bailian-files/` 也必须保留。

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill description contains very broad natural-language triggers covering many common bidding-related phrases, which can cause the agent to invoke the skill in situations where the user did not clearly intend cloud processing. Because this skill uploads sensitive tender and bid documents to a remote service and may incur billing, over-broad activation increases the risk of unintended data disclosure and unintended paid actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill acknowledges that user files are uploaded to a cloud service, but the warning appears in a general permissions section rather than being enforced at each workflow entry point. In practice, users may provide sensitive commercial, pricing, or personal documents and trigger upload flows without receiving a timely, contextual warning and consent checkpoint, increasing the chance of inadvertent third-party disclosure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document is written entirely in Chinese and presents user-facing wording requirements such as '展示给用户时统一说“可用字数”' without indicating that language should follow user preference. This creates a locale/language policy concern because it implicitly enforces Chinese output rather than offering a choice or documenting a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file states that uploaded files and task results are retained on the 百炼®标书 server for about 7 days. That behavior can affect user data and privacy, but the document presents it as an operational detail rather than a user-facing warning or caution.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: L25 establishes a security boundary forbidding display or forwarding of links containing an Api Key or bind_key. However, the same document describes obtaining results via a download-url workflow (L22) and short-lived finished-product download links (L13), creating a documentation-level contradiction about whether such links are to be surfaced or relayed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file states that script output and reports have already been converted to Chinese and should be presented directly in Chinese. This imposes a language choice on users without indicating that they can choose another language or locale, which is a natural-language policy concern under the locale-choice rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The raised error message is written only in Chinese, which imposes a specific language on users without any visible opt-in or fallback. Under the policy rule, forcing a specific language without user choice is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The command-line description and argument help strings are all presented only in Chinese, which forces a single language for user interaction. There is no indication that the tool is region-specific or that users can opt into another language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code hard-codes Chinese report titles and labels such as "招标文件智能解读报告" and mixed Chinese headings, which indicates the skill outputs a specific language by default. Under the policy, forcing a specific language without offering a user language/locale choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The compliance renderer constructs report headings and field labels entirely in Chinese, for example "合规审查报告" and "审查对象". There is no visible opt-in, fallback, or configuration path for another language, so the file appears to impose a locale choice unconditionally.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This renderer emits report names, labels, and legal disclaimers in Chinese only, including "标书查重报告" and the Chinese-only callout text. Because no opt-in or locale selection is present in this file, it creates a policy concern around forced language/locale behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The generated HTML hard-codes lang='zh-CN', which imposes a specific language/locale on all output. The file also contains multiple fixed Chinese UI strings throughout the rendered report, and there is no visible option for the caller or user to select another locale or opt in to Chinese output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file emits natural-language messages in Chinese in check_size, which imposes a specific language on users. Under the policy, forcing a language without user opt-in or documented regional justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: check_total_size terminates with a Chinese-only message, again enforcing a specific language choice in user-visible output. The file does not indicate that the skill is region-specific or that users can choose their language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: When a file is absent, the code exits with a Chinese-only error message. This is a user-facing locale restriction embedded in code and matches the policy's language/locale violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The string literal "请求失败 HTTP" hardcodes Chinese for a user-visible error message, which imposes a specific language without offering the user a locale choice. The policy for natural-language content requires avoiding forced language/locale behavior unless it is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This code hardcodes Chinese-language user messages in multiple execution paths, including errors and timeout notices, with no indication that the user can choose another language. That creates a locale policy issue because the skill imposes a specific language rather than offering opt-in or documenting a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The download and progress-reporting flows emit Chinese-only status text to users, including operational guidance and warnings, without any opt-in or alternate locale handling. Under the policy, forcing a specific language in natural-language output is a violation unless the skill explicitly offers a choice or is clearly documented as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The monitoring loop prints all human-readable status updates, retry notices, failures, and timeout messages in Chinese only. Because there is no visible language selection, opt-in, or documented locale limitation in this file, the skill appears to enforce a single language in violation of the stated policy.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · scripts/zcm_lib/parser.py (reported line 13)May include surrounding context.
python
contract_snapshot, funcs, description, include_skillhub_auth=False, allow_remote_files=False, include_feedback=False, ):

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The version string shown to users is hard-coded in Chinese, which imposes a specific language on all users without opt-in. This is a natural-language policy concern because the file contains user-facing text but provides no alternative locale selection or documented justification for the restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Across the parser, command names and help text presented to users are written in Chinese only, with no evidence of user choice for language or locale. Under the stated policy, forcing a specific language without opt-in is a reportable natural-language policy violation unless clearly documented as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file formats all user-visible progress and duration text in Chinese, including time units and status messages, without any apparent locale selection or opt-in. The stated policy for this audit flags language/locale constraints when the skill forces a specific language rather than offering a choice or clearly documenting a justified regional limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The main progress-line formatter emits Chinese-only status text such as queueing, completion, failure, and progress updates, and also rewrites labels into Chinese. Because these are direct user-facing outputs with no visible language choice mechanism, they constitute a locale policy violation under the provided criteria.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/zcm_lib/reporting.py:59