Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
- Without declared permissions the skill's intent is opaque and cannot be validated.
Security audit
智能标书编制
Security checks across malware telemetry and agentic risk
Overview
The skill is a bounded bidding-document assistant that sends user-selected files to its disclosed cloud API and stores limited local metadata for credentials, outputs, and report naming.
Before installing, understand that tender and bid files can contain sensitive commercial, pricing, and personal information and will be uploaded to the 百炼®标书 cloud under your API-key account. Keep the API key out of chat, review the vendor's retention/account controls, and be aware that limited local metadata is cached for report naming in addition to generated outputs and config.json.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
- This is a mismatch because the description focuses on four user-facing business functions: tender interpretation, bid document generation, compliance review, and duplicate checking. The code does implement those, but it also provides additional user-exposed capabilities not mentioned in the description, especially knowledge-base access, package extraction, credential/account management, and generalized job-control/download tooling. These are not just internal helpers; they are explicit CLI features and API operations. The code also only accepts local file paths rather than generally 'uploading' arbitrary provided documents, but the bigger issue under the stated criteria is the presence of undeclared capabilities.
Description-Behavior Mismatch
Low
- Confidence
- 92% confidence
- Finding
- The manifest describes document interpretation, bid document generation, compliance review, and duplicate checking for uploaded tender/bid files. This code also exposes a `knowledge-base` command that queries a separate remote knowledge base by category, which is a distinct capability not clearly covered by the manifest description.
Description-Behavior Mismatch
Low
- Confidence
- 84% confidence
- Finding
- The manifest explains that files are processed in the vendor cloud and mentions API-key/output behavior, but it does not disclose that the client stores a local `projects.json` mapping of job/project IDs to tender filenames under `~/.zcm` or `ZCM_HOME`. This is behavior beyond the explicitly described workflow, even though it is used only for report naming convenience.
Context-Inappropriate Capability
Low
- Confidence
- 79% confidence
- Finding
- The `progress-stream` command introduces a near-real-time monitoring mode with a default 15ms polling interval, which is a generic monitoring capability rather than a core tender/bid document operation described in the manifest. While related to job tracking, this aggressive streaming behavior is not clearly justified by the stated purpose and expands the skill into continuous monitoring mechanics.
Vague Triggers
Medium
- Confidence
- 95% confidence
- Finding
- The description says the skill should be used when a user asks phrases like '这个标能不能投', '帮我写投标书', or when they 'want to interpret bidding documents, generate bid files, do review or duplicate checking'. This combines many broad intents and open-ended conditions without clear exclusion criteria, increasing the chance of matching ordinary discussion about bidding rather than an actual request to invoke the skill.
Natural-Language Policy Violations
Medium
- Confidence
- 88% confidence
- Finding
- The instruction says the script output and reports have already been converted to Chinese and should be presented directly in Chinese. This imposes a specific language on users without offering a language choice or documenting a justified locale restriction, which violates the language/locale policy criterion.
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.