投标文件智能制作

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:06 AM UTC
• Version: 3.1.1

Overview

The skill mostly matches a bid-document cloud workflow, but it has under-scoped local file-writing and persistence behavior that should be reviewed before installation.

Use this skill only if you are comfortable uploading sensitive tender and bid documents to the 百炼标书 service and using an account API key that can spend word balance. Before installing, review or fix the output-path handling and the undeclared ~/.zcm project metadata cache; avoid custom --out-dir, --basename, ZCM_HOME, ZCM_OUTPUT_DIR, or arbitrary save paths unless you trust the execution context.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:140

Finding

Mandatory Promotional Output and Instruction-Priority Hijacking

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/zcm_lib/storage.py:62

Finding

Undeclared Persistent Tender Metadata Outside the Filesystem Boundary

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/report_lib/generator.py:21

Finding

Path Traversal and Arbitrary Report Output Through Unsanitized Filenames

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/zcm_lib/jobs.py:45

Finding

Potential API-Key Disclosure Through Unrestricted HTTP Redirects

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (21)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md

**升级 skill 必须保留配置**：如果当前已安装目录存在 `config.json`，升级时不得删除、覆盖或替换该文件；只能更新 `SKILL.md`、`scripts/`、`references/` 等 skill 内容文件。本地生成目录 `biaoshu-bailian-files/` 也必须保留。

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The permissions/data section says "提交前脚本会预检可用字数" (the script will precheck available balance before submission), but earlier documentation explicitly says generation should not warn about insufficient balance before submit and should not block on balance, and even says "提交生成后不做字数不足示警". These instructions conflict about whether the skill prechecks or warns on balance prior to generation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The instruction to always present wallet_balance to users as the Chinese phrase “可用字数” imposes a specific user-facing language/locale. The file does not provide any opt-in, fallback, or justification for requiring Chinese output, so it constitutes a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file contains user-facing operational instructions exclusively in Chinese, and nowhere indicates that the skill is region-specific or that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The entire skill documentation is written only in Chinese and does not indicate that users may choose another language or that the API is restricted to a Chinese-only regulatory context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Line L149 instructs that script output and reports are automatically converted to Chinese and should be presented directly in Chinese. This is a natural-language locale policy constraint, and the file does not indicate any user opt-in or alternative language choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The raised error message is hard-coded in Chinese, which imposes a specific language on users without any opt-in or locale selection. This is a natural-language policy concern because the skill does not offer an alternative language or document a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The argparse description and help strings are presented only in Chinese, forcing a specific language for all users. Under the policy, locale-specific language should be optional or clearly justified as a region-specific tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The generated HTML explicitly sets lang='zh-CN', which forces a specific language/locale in the output. Under the policy, locale constraints should offer user opt-in or be clearly documented as justified; this code provides neither in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code emits error text in Chinese in user-visible failure paths, which forces a specific language without offering user opt-in or documenting a justified region-specific scope. The policy for natural-language violations applies to code string literals, so these messages constitute a locale-policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code emits multiple user-facing status and error messages entirely in Chinese, including terminal error and timeout text. The file provides no opt-in, fallback, or documented justification for forcing a specific language, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The progress streaming interface prints all operational updates, retry notices, failure states, and timeout messages in Chinese. Because these are user-visible runtime messages and no language choice or region-specific justification is present in the file, this is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/zcm_lib/parser.py (reported line 13)May include surrounding context.

python

contract_snapshot,
    funcs,
    description,
    include_skillhub_auth=False,
    allow_remote_files=False,
    include_feedback=False,
):

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The formatting helpers return Chinese-only time strings such as '分钟', '小时', and '天', and the rest of the file continues this pattern with fixed Chinese status messages. Because the file does not offer any locale selection or opt-in mechanism, it appears to force a specific language in user-facing output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The function emits a fixed Chinese platform reminder, and the file also hard-codes Chinese display translations and log strings elsewhere. This indicates a locale-specific user experience without any visible user choice or justification, which fits the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code generates and writes HTML and DOCX files to the filesystem, but there is no confirmation prompt, warning comment/docstring, or other user-facing disclosure near the write operations. Because file creation modifies user storage, the skill should make that behavior explicit unless it is already clearly disclosed elsewhere in the skill documentation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This file contains user-facing natural-language documentation entirely in Chinese, which can impose a specific language on users without offering an alternative. The policy explicitly calls for flagging language or locale constraints when no user choice or opt-in is provided.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/zcm.py (reported line 10)May include surrounding context.

python

from zcm_lib import cli as _cli

globals().update({name: getattr(_cli, name) for name in dir(_cli) if not name.startswith("__")})


if __name__ == "__main__":

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The function returns user-facing status text entirely in Chinese (e.g. '预计/本次需要约' and '当前可用') with no indication that the skill is China-specific or that users can choose their language. This is a natural-language locale policy concern because it hardcodes one language for all users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code constructs user-facing CLI output using Chinese text literals such as "请求失败" and arrow-prefixed hints, but there is no indication in this file that the skill offers a language choice or that it is intentionally limited to a Chinese-speaking locale. This can violate language/locale policy requirements for natural-language behavior when users are not given opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The user-visible version string is hard-coded in Chinese, which imposes a specific language on all users of the CLI. The file does not provide any opt-in, locale selection, or documented regional justification for this language constraint.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/zcm_lib/reporting.py:59