T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:64- Finding
Mandatory Promotional Rules Hijack Agent Output and Instruction Priority
- Content
View full analysis
- Remediation
View remediation
Security audit
标书智能制作
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly aligned with bidding-document workflows, but it needs Review because it handles sensitive procurement files and credentials while also showing under-scoped local persistence, broad output writes, unsafe redirect handling, and instruction-priority overreach.
Review before installing if you handle confidential bids. Use it only for documents you are authorized to upload to biaoshu.zhiliaobiaoxun.com, prefer a dedicated revocable API key, confirm any billed generation/review before submission, and avoid letting prompts or untrusted content choose arbitrary local output paths. Be aware it may retain tender filename metadata locally under ~/.zcm or ZCM_HOME in addition to generated reports and the skill-local API-key config.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/zcm_lib/storage.py:62- Finding
Persistent Project Metadata Is Written Outside the Declared Filesystem Boundary
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/report_lib/generator.py:20- Finding
Unrestricted Output Paths Permit Arbitrary File Creation and Overwrite
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/zcm_lib/http_client.py:40- Finding
Authenticated HTTP Requests Can Follow Unvalidated Cross-Origin Redirects
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (36)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md **升级 skill 必须保留配置**：如果当前已安装目录存在 `config.json`，升级时不得删除、覆盖或替换该文件；只能更新 `SKILL.md`、`scripts/`、`references/` 等 skill 内容文件。本地生成目录 `biaoshu-bailian-files/` 也必须保留。
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
All user-facing instructions and examples in this file are written in Chinese, including mandated user phrasing such as '展示给用户时统一说“可用字数”' and '必须把 ... 转述给用户'. That indicates a language constraint for agent output, but the file does not provide user opt-in, multilingual options, or a documented justification that the skill is limited to Chinese users only.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation instructs users to upload tender documents directly or by URL but provides no warning about privacy, confidentiality, or secure handling of potentially sensitive procurement data. Tender files often contain proprietary business information, personal data, pricing, and compliance material, so omission of data-handling guidance can lead to unsafe sharing, third-party URL exposure, or noncompliant processing.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file presents all user-facing instructions and API usage details only in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not stated here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The document states that uploaded files and task results are retained on the vendor server and may persist for about 7 days, but it does not pair this with a clear privacy warning, consent requirement, or handling guidance for sensitive bid materials. In this skill context, users may upload confidential procurement documents, so omission of an explicit user-facing disclosure increases the risk of unintended exposure of sensitive business data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The entire skill reference is written only in Chinese and provides no indication that another language can be used or that Chinese is a required, justified locale for a region-specific workflow. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The instruction says script output and reports have already been converted to Chinese and should be presented directly in Chinese. This imposes a specific language on user-facing responses without documenting a user choice or opt-in, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The exception text is hardcoded in Chinese, and the CLI description/help strings in this file are also written only in Chinese, which imposes a specific language on users without opt-in. Under the policy, locale or language constraints should either be optional, user-selectable, or clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The command-line description and argument help text are presented only in Chinese, which enforces a single language for interaction. The file does not offer a language choice or explain that the tool is intentionally limited to a Chinese-speaking context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code generates report titles and labels in Chinese, and the same pattern continues throughout the file. Because the skill forces a specific language/locale in user-facing output with no opt-in or alternative selection, it matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The compliance renderer presents the report name, cover labels, and later section headings in Chinese only. This is a natural-language policy issue because the file imposes a language choice on users without offering selection or documenting a justified region-specific scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The duplicate-review renderer uses Chinese report names and labels for cover metadata and subsequent sections. This forces a specific language in generated output without user opt-in, which fits the stated policy-violation category.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The file contains multiple embedded user-visible strings in Chinese, such as headings, labels, and branding, and does not expose any option to select another language. That effectively forces a single locale in generated reports, which falls under the language/locale policy violation category.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The generated HTML hard-codes
lang='zh-CN', which enforces a specific language/locale choice for all rendered reports. This is a natural-language policy concern because the file does not provide any user choice or documented justification for restricting output to Chinese.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The function returns hard-coded Chinese-language user-facing messages such as "预计/本次需要约" and "当前可用". This imposes a specific language on all users without offering a language choice or documenting a justified locale-specific constraint, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The error messages shown to users are written directly in Chinese, and the file provides no mechanism for language selection or opt-in. This can violate language/locale policy when users are not explicitly offered a choice or the locale restriction is not documented as justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This message is presented directly to the user in Chinese and there is no indication that other locales are supported or that the user opted into Chinese. Hard-coded locale-specific messaging can violate organizational language policy when no choice is provided.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The function builds a multipart/form-data body from local files and reads each file's full contents into memory for transmission. While the docstring notes the request-body purpose, there is no user-facing disclosure, confirmation, or explicit warning in this file about uploading local file data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file-not-found message is a user-visible string in Chinese, but the code does not offer locale configuration or explain a Chinese-only scope. That creates a natural-language policy issue if users are expected to interact in other languages by default.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The error message string is hard-coded in Chinese ("请求失败 HTTP ..."), which imposes a specific language on users without any visible opt-in or locale selection mechanism. That is a natural-language policy issue because the file does not document that the skill is intentionally region-specific or provide a language choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code emits multiple natural-language strings in Chinese, beginning here and continuing throughout the file, for errors, progress, and usage guidance. Because the skill forces a specific language in user-facing output without user opt-in or a documented region-specific constraint, it violates the language/locale policy criteria.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
python contract_snapshot, funcs, description, include_skillhub_auth=False, allow_remote_files=False, include_feedback=False, ):
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The version string is hard-coded in Chinese, and throughout the parser the user-facing help text is also exclusively Chinese. This imposes a specific language on all users without opt-in or any indication that the skill is intended only for a Chinese-language or region-specific environment.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The formatting functions return Chinese-only duration strings such as "分钟", "小时", and "天", and the rest of the module similarly emits fixed Chinese status text. This is a natural-language policy concern because the file enforces a specific locale in user-facing output without offering a language choice or documenting that the skill is intentionally Chinese-only.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file defines fixed Chinese translations for risk and priority labels, and later uses them for display without any visible mechanism for user language selection. This can violate a language/locale policy when the skill forces a specific locale rather than offering opt-in or fallback behavior.
- Content
Static analysis
Detected: suspicious.dynamic_code_execution
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- scripts/zcm_lib/reporting.py:59