T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:139- Finding
Persistent Agent Output and Promotional Instruction Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
标书检查工具
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to provide the advertised bid-document workflow, but it needs review because it handles sensitive files and account credentials while some code and instructions exceed the declared boundaries.
Install only if you trust the vendor with confidential tender/bid files and the API-key account. Before first use, confirm uploads, server-side retention, and billing are acceptable; keep the API key out of chat; prefer the default output directory; avoid broad ZCM_OUTPUT_DIR or arbitrary -o paths; and rotate the API key if you suspect it was exposed. This is a review finding, not evidence that the skill is intentionally malicious.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/zcm_lib/http_client.py:38- Finding
API Credential Exposure Through Unrestricted Cross-Origin HTTP Redirects
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/zcm_lib/storage.py:45- Finding
Unrestricted Filesystem Writes Outside the Declared Skill Boundary
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (25)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md **升级 skill 必须保留配置**：如果当前已安装目录存在 `config.json`，升级时不得删除、覆盖或替换该文件；只能更新 `SKILL.md`、`scripts/`、`references/` 等 skill 内容文件。本地生成目录 `biaoshu-bailian-files/` 也必须保留。
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The API documentation explicitly supports uploading tender documents either directly or by external URL, but it provides no privacy, retention, access-control, or third-party fetch safeguards. Tender files commonly contain sensitive commercial, legal, and personal data, so this omission can lead integrators to build insecure workflows and can also enable server-side fetching of attacker-controlled URLs without adequate validation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The file presents all user-facing instructions and API usage details exclusively in Chinese. Under the policy for natural-language violations, forcing a specific language without user opt-in or justification is a reportable issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The file presents all operational instructions, parameters, and errors only in Chinese. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documentation states that uploaded files and task results are retained on the vendor's servers for about 7 days, but it does not pair that with a clear privacy, consent, or data-handling warning to operators or end users. In a bid-document workflow, uploads may contain confidential business, pricing, or personal data, so silent retention can create compliance and confidentiality risks if users are not informed or if sensitive data is submitted unnecessarily.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The entire skill guidance is written only in Chinese, with no indication that users may choose another language or that the skill is limited to a Chinese-only audience for a documented compliance or regional reason. Under the policy, forcing a specific language without opt-in is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The report renderer hard-codes Chinese titles and labels such as "招标文件智能解读报告" and "项目句柄", establishing a fixed output language in natural-language strings. The file contains the same pattern throughout multiple renderers, but this section is sufficient to show a language/locale policy issue because no user opt-in or locale selection is offered.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The generated HTML hard-codes
lang='zh-CN', which imposes a specific language/locale choice on all rendered reports. The file also contains extensive Chinese-only user-facing text, but does not offer any locale selection or explain that the skill is intentionally region-specific.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code emits Chinese-only messages in a general-purpose file helper, which enforces a specific language for users regardless of their locale or preferences. The file does not indicate that the skill is region-specific or provide any opt-in or fallback language behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The error message string is hard-coded in Chinese ("请求失败 HTTP ...") with no indication that users can select their preferred language. This creates a natural-language locale policy issue because the skill imposes a specific language without opt-in or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code emits multiple mandatory Chinese-only user messages such as terminal errors and timeout notices, and the file contains no indication that the skill is limited to Chinese-speaking users or provides a language opt-in. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The download-link and result guidance shown to users is entirely in Chinese, including operational instructions about saving files and partial results. Because the file does not offer language selection or document a justified Chinese-only scope, this violates the language/locale policy.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The progress streaming path prints all monitoring, retry, failure, and timeout messages in Chinese, which effectively forces that locale on users. Since no opt-in, configuration, or documented locale restriction is present in this file, it matches the policy's prohibited language forcing behavior.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
python contract_snapshot, funcs, description, include_skillhub_auth=False, allow_remote_files=False, include_feedback=False, ):
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The formatting helpers return Chinese-only time strings such as "分钟", "小时", and "天", and the rest of the file also emits Chinese UI text. This enforces a specific language/locale in user-facing output with no opt-in, fallback, or documented region-specific justification, which matches the language policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The function builds all progress and delivery messages in Chinese, including labels like "处理中", "任务已完成", and "我会继续后台监听，完成后交付成品链接". Because the file contains only hard-coded Chinese output and no user language selection or explicit regional scope, it violates the natural-language locale policy rule.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
Line L69 states that callers 'must truthfully say' the result is partial or that semantic review is incomplete, but the surrounding file only defines an API contract and response fields, not any code or protocol behavior that would enforce or guarantee that representation. This creates an intent-level divergence within the documentation: the normative instruction implies an assurance about output handling that the described API itself does not implement.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
This file is documentation rather than executable code, so only intent-level contradictions are applicable. The security boundary at L25 warns against exposing sensitive links, while earlier global guidance at L22 describes obtaining results via
download-url, creating a mild documentation-level tension because the document does not reconcile safe handling of those URLs.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The module docstring is written entirely in Chinese and describes the script’s purpose only in that language, which can indicate a language-specific constraint without offering user choice or opt-in. Under the policy rule for natural-language violations, forcing a specific language without documented choice can be a locale/language policy issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This file contains a hard-coded Chinese error message, and the CLI description/help text is also entirely Chinese. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation because the skill does not provide any language or locale choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The only user-facing natural-language text in this file is written entirely in Chinese and gives no indication that other languages are supported or that the language choice is configurable. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Confidence
- 50% confidence
- Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
- Content
python from zcm_lib import cli as _cli globals().update({name: getattr(_cli, name) for name in dir(_cli) if not name.startswith("__")}) if __name__ == "__main__":
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This helper sends outbound HTTP requests and may include caller-provided headers and request bodies, but the file contains no confirmation prompt, user-facing log/print, or warning text about transmitting data over the network. Because network calls that transmit user or system data are safety-relevant, the lack of any disclosure in the code qualifies under the code-file warning criterion.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The --version string is hard-coded in Chinese, which imposes a specific language on all users regardless of locale or preference. The policy allows locale constraints only when users can opt in or when the restriction is clearly documented and justified, neither of which is present here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The function emits a fixed Chinese message directing users to a platform, and the file also contains multiple Chinese-only display strings. If organizational policy requires language choice or user opt-in for locale, this hard-coded locale behavior is a natural-language policy concern because no alternative language path is offered here.
- Content
Static analysis
Detected: suspicious.dynamic_code_execution
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- scripts/zcm_lib/reporting.py:59