Security audit

招标文件解读工具

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly purpose-aligned, but it needs Review because it handles sensitive bid documents and credentials while also retaining undeclared local metadata and allowing under-scoped local file writes.

Install only if you are comfortable sending tender and bid documents, which may contain confidential business data, to the vendor service under your API-key account. Before use, confirm the vendor retention and account-management terms, keep config.json private, avoid untrusted custom report basenames or output directories, and be aware that ~/.zcm/projects.json may retain document names and job/project IDs unless removed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:142
Finding: Mandatory Instruction-Priority Override and Branded Output Injection
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/zcm_lib/storage.py:62
Finding: Undeclared Persistent State Written Outside the Declared Filesystem Boundary
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/report_lib/generator.py:13
Finding: Arbitrary File Write Through Unsanitized Report Basename and Output Directory
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (28)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
**升级 skill 必须保留配置**：如果当前已安装目录存在 `config.json`，升级时不得删除、覆盖或替换该文件；只能更新 `SKILL.md`、`scripts/`、`references/` 等 skill 内容文件。本地生成目录 `biaoshu-bailian-files/` 也必须保留。

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: Line L27 instructs the agent to present a specific user-facing term in Chinese: “展示给用户时统一说‘可用字数’”. This is a language/locale constraint in natural-language guidance and does not offer the user a language choice or opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The workflow instructs users to upload tender/bid documents to remote APIs but does not warn that such files may contain sensitive commercial, legal, pricing, or personally identifiable information. This omission can lead users to disclose confidential material without understanding the privacy, retention, and third-party processing implications, increasing the risk of data leakage or compliance violations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file states that uploaded files and task results are stored on the 百炼®标书 server and retained for about 7 days. That is a data-handling behavior with privacy implications, but the document presents it as an operational note rather than a clear warning or caution to users.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The entire skill guidance is written in Chinese and does not indicate that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Line L149 states that output and reports have already been converted to Chinese and should be presented directly in Chinese. This imposes a specific language on users without documenting a locale-specific justification or offering a user choice, which matches the language/locale policy-violation criterion.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file contains extensive natural-language UI/report text in Chinese, including section headers and report titles, with no visible mechanism for user language selection or documentation that the skill is intentionally limited to a Chinese-language context. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The generated HTML explicitly sets lang='zh-CN' and uses fixed Chinese branding and footer text, while other strings throughout the file are also hardcoded in Chinese. This enforces a specific language/locale in the rendered report without any visible user opt-in or configuration mechanism, matching the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file emits natural-language messages in Chinese when validation fails, which enforces a specific language for users. This is a locale-policy concern because the code does not offer any mechanism for language selection or document a justified region-specific restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This line presents a user-visible size-limit error only in Chinese, again forcing a single language in normal operation. Without opt-in, configurability, or clear regional justification, this matches the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This is another user-facing message that forces Chinese output regardless of user preference. Repeated hard-coded locale-specific strings indicate the skill does not offer a language choice or documented locale limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The error output uses Chinese text such as '请求失败' and 'message' formatting directly in user-facing CLI messages. This imposes a specific language without any visible opt-in, fallback, or documented region-specific justification in the file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code emits multiple hard-coded Chinese user-facing messages, and the pattern continues throughout the file in logs, errors, and progress output. That imposes a specific language on users without any visible language selection or documented region-specific constraint, which violates the language/locale policy for natural-language behavior.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · scripts/zcm_lib/parser.py (reported line 13)May include surrounding context.
python
contract_snapshot, funcs, description, include_skillhub_auth=False, allow_remote_files=False, include_feedback=False, ):

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The version string shown to users is hard-coded in Chinese, which imposes a specific language on all users. In this file there is no opt-in, alternative locale, or documentation indicating that the skill is intentionally limited to Chinese-speaking users.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code formats user-facing duration strings entirely in Chinese (for example, 分、秒、小时、天) and later constructs additional Chinese progress text. The policy for natural-language violations applies to all file types, and there is no indication here that users can opt into Chinese output or that the skill is explicitly limited to a Chinese-language context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The function builds all progress updates in Chinese, including status headings, stage descriptions, and completion text such as “任务已提交，正在排队” and “我会继续后台监听，完成后交付成品链接”. Because no language choice, fallback, or documented regional justification is present in this file, this is a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file hard-codes Chinese translations for risk and priority labels and uses Chinese user-facing log messages throughout the reporting flow. This creates a locale-specific user experience without any visible opt-in, fallback, or configuration mechanism, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The skill documentation is entirely in Chinese and presents the workflow as Chinese-only without indicating that users can choose another language or that the locale restriction is intentional. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file contains user-facing API documentation exclusively in Chinese, and nowhere indicates that the skill supports multiple languages or that Chinese is a justified locale restriction. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: At L26, the document states that semantic_review=false or enable_semantic_review=false disables semantic review and leaves only rule-based checking. But L69 instructs consumers that if semantic_review or partial_summary indicates semantic review is not fully completed, they must present the result as partial/incomplete. This creates an intent-level contradiction between an intentionally disabled semantic review and an incomplete semantic review state.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file presents all user-facing documentation and operational instructions exclusively in Chinese, and it does not state that the skill is region-specific or provide any opt-in or language-selection mechanism. Under the policy criteria, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The exception text is hardcoded in Chinese, which imposes a specific language on users without any opt-in or alternative locale. This matches the policy category for language or locale constraints because the file also contains user-facing CLI text only in Chinese.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The argparse description and help strings are all presented in Chinese, which forces a single language for user interaction. There is no indication of locale choice, fallback, or documented justification for this restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The natural-language documentation is entirely in Chinese and does not indicate that other languages are supported or that the locale restriction is intentional. Under the stated policy, forcing a specific language without user opt-in can be a language/locale policy violation.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/zcm_lib/reporting.py:59