Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
- Without declared permissions the skill's intent is opaque and cannot be validated.
Security audit
标书智能制作
Security checks across malware telemetry and agentic risk
Overview
The skill mainly does what it claims, but it has under-described access to account knowledge-base data and writes a local project cache outside its declared write paths.
Install only if you are comfortable uploading tender and bid documents to the 百炼®标书 cloud service and having results retained under the API-key account. Be aware that the skill can query account knowledge-base data and can leave local metadata in ~/.zcm/projects.json in addition to the skill-local config.json API key and generated output files.
SkillSpector
By NVIDIA
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
- The code does implement the core described functions: tender interpretation, bid generation, compliance review, and duplicate checking via a cloud API, plus report generation. However, it also exposes several additional end-user capabilities not stated in the description, especially knowledge-base access and package extraction, along with substantial job/credential management features. Those are not just internal implementation details because they are explicit user-facing commands. Therefore the description does not fully represent what the code actually does.
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.