Security audit

招标文件解析助手

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for bid-document processing, but it needs review because it overreaches on assistant instructions and has under-scoped local write, persistence, and credential-safety risks.

Review carefully before installing, especially for confidential bid materials. Use it only if you trust the 百炼标书 service, understand that files are uploaded and retained server-side, and accept billable API-key operations. Keep the API key out of chat, avoid arbitrary output paths, and prefer a contained output directory until the publisher fixes the instruction-priority language, local metadata storage, path containment, overwrite behavior, and redirect handling.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:143
Finding: Mandatory Instruction-Priority Override and Promotional Output Hijacking
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/zcm_lib/storage.py:62
Finding: Undeclared Persistent Read and Write Access to the User Home Directory
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/report_lib/generator.py:21
Finding: Unrestricted Output Paths Permit Arbitrary File Overwrite
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/zcm_lib/http_client.py:40
Finding: Authenticated Requests Follow Redirects Without Destination Validation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (33)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
**升级 skill 必须保留配置**：如果当前已安装目录存在 `config.json`，升级时不得删除、覆盖或替换该文件；只能更新 `SKILL.md`、`scripts/`、`references/` 等 skill 内容文件。本地生成目录 `biaoshu-bailian-files/` 也必须保留。

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill gives conflicting billing behavior: one section says generation should not warn or block on insufficient balance, while another says the script will pre-check available quota before submission. In a paid workflow, this inconsistency can cause the agent to mislead users about charges, fail open or fail closed unpredictably, and trigger unintended billable operations or confusing recovery paths.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This file contains natural-language instructions and examples exclusively in Chinese, including mandated user-facing wording such as how to present balances and progress updates. Under the policy, forcing a specific language without user opt-in is a locale-policy concern unless the restriction is explicitly justified, which is not stated here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This file contains end-user/developer instructions exclusively in Chinese, and there is no natural-language indication that the skill supports other languages or that Chinese is a required locale. Under the policy rule for language/locale constraints, forcing a single language without opt-in can be a policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The entire skill specification is written only in Chinese and does not indicate that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document explicitly states that uploaded files and task results are retained on the vendor server and may persist for about 7 days, but it does not pair this with a clear user-facing privacy warning, consent requirement, or handling guidance for sensitive procurement documents. In the context of bid/tender materials, retained server-side storage can expose confidential business, pricing, or compliance data if users are not adequately informed before upload.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Line L149 instructs that output and reports are 'automatically converted to Chinese' and should be presented directly in Chinese. This imposes a specific language on the user without offering a language choice or documenting a justified locale restriction, which fits the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The error message and command-line descriptions are written only in Chinese, which imposes a specific language on users without opt-in. Under the policy, forcing a locale or language without offering user choice or clear region-specific justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: All argparse descriptions and help strings in this range are presented exclusively in Chinese. This creates a fixed language experience for users without opt-in or documented justification, matching the language-policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The rendered HTML hard-codes lang='zh-CN', which imposes a specific language/locale on all generated reports. This file does not offer a user-selectable locale or document why Chinese-only output is required, so it conflicts with the policy against forcing a language without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The function constructs user-facing status messages entirely in Chinese (for example, '预计/本次需要约' and '当前可用') with no indication that the user can choose another language. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly documented as region-specific or justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file emits natural-language messages in Chinese in multiple failure paths, which effectively forces a specific language for users encountering these errors. Under the policy, locale-specific language is a violation unless the skill offers a language choice or clearly documents a justified regional constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This line presents a user-visible failure message only in Chinese, again imposing a specific language choice on all users. No nearby code or documentation in this file indicates locale selection or a justified regional limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This user-facing termination path prints only Chinese text, which is a natural-language policy issue when no opt-in language handling is present. The file contains no mechanism to adapt messaging to user preference or locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The error message literal "请求失败 HTTP ..." hard-codes Chinese output in a shared HTTP helper, which imposes a specific language on users without any opt-in or documented regional limitation. This is a natural-language policy concern because the file provides no indication that the skill is intentionally restricted to Chinese-speaking users or offers locale selection.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code emits user-facing status and error messages entirely in Chinese, including terminal errors and timeout guidance. Because the file provides no opt-in, language selection, or documented locale restriction, it violates the language/locale policy for natural-language content.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · scripts/zcm_lib/parser.py (reported line 13)May include surrounding context.
python
contract_snapshot, funcs, description, include_skillhub_auth=False, allow_remote_files=False, include_feedback=False, ):

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code embeds user-facing version/help text in Chinese, and the rest of the parser definitions continue that pattern, which effectively fixes the skill's interface language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code formats durations using Chinese-only output such as '分钟', '小时', and '天', and the rest of the file continues that pattern for all progress messages. Under the natural-language policy rule, forcing a specific language without user opt-in is a locale policy violation unless the constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The function constructs all user-visible progress text in Chinese, including status headings, stage descriptions, and completion notices, with no mechanism for users to choose another language. This is a natural-language locale constraint and should be treated as a policy issue unless explicitly documented as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown file presents all user-facing instructions and API guidance exclusively in Chinese. Under the policy rule, forcing a specific language without user opt-in or documented locale justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The file presents all operational guidance in Chinese and does not indicate that language selection is optional or user-configurable. Under the language/locale policy, forcing a single language without opt-in can be a natural-language policy concern unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: This code writes generated HTML and DOCX reports to the filesystem, which is a safety-relevant file write operation. While the CLI arguments imply output behavior, there is no explicit warning, confirmation, or user-facing disclosure in the write path itself beyond printing the resulting path afterward.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code hard-codes Chinese report titles and labels such as "招标文件智能解读报告" and "项目句柄", indicating the generated report content is fixed to Chinese. The file does not offer a user-selectable language or document a justified locale restriction, which is a natural-language policy concern under the language/locale rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The compliance renderer uses fixed Chinese strings for the report name, cover labels, and section content, which constrains output language regardless of user preference. No opt-in, fallback, or documented justification for the locale restriction appears in this file.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/zcm_lib/reporting.py:59