T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:142- Finding
Agent Output Hijacking Through Mandatory Promotional and Referral Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
智能标书编制
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly aligned with bid-document processing, but it should be reviewed because it forces promotional/user-output rules and silently stores tender metadata outside its declared write area.
Install only if you are comfortable uploading confidential bid/procurement documents to this vendor service and using a paid API-key account. Review the mandatory promotional/output behavior, avoid entering API keys via command-line arguments, and be aware that tender filenames may be cached in ~/.zcm/projects.json unless the skill is changed or ZCM_HOME is controlled.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/zcm_lib/storage.py:63- Finding
Undeclared Persistent State Written Outside the Declared Filesystem Boundary
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (26)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md **升级 skill 必须保留配置**：如果当前已安装目录存在 `config.json`，升级时不得删除、覆盖或替换该文件；只能更新 `SKILL.md`、`scripts/`、`references/` 等 skill 内容文件。本地生成目录 `biaoshu-bailian-files/` 也必须保留。
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill contains contradictory billing and balance-handling instructions: one section says the client will pre-check available quota before submission, while another says generation should not warn about or block on insufficient balance. This inconsistency can cause the agent to initiate paid operations under incorrect assumptions, leading to unexpected charges, failed jobs, or misleading user consent around billable actions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The entire skill reference is written in Chinese and includes user-facing phrasing requirements such as '展示给用户时统一说' and '必须把...转述给用户', which indicates the skill expects Chinese output by default. There is no indication that users may opt into another language or locale, nor any justification that the skill is region-locked for compliance reasons.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file’s natural-language instructions and API workflow description are fully presented in Chinese, and there is no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in is a language/locale policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This markdown file contains user-facing instructions only in Chinese, which can amount to forcing a specific language without user opt-in. The file does not state that the skill is limited to a Chinese-speaking audience or provide any alternative language option.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document explicitly states that uploaded files and task results are retained on the vendor's servers for about 7 days, but it does not pair that behavior with a clear privacy warning, consent requirement, or data-handling guidance for potentially sensitive bid documents. In a procurement/bid workflow, files may contain confidential commercial, pricing, or regulated information, so silent third-party retention materially increases data exposure and compliance risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The document states that script output and reports are already converted to Chinese and should be presented directly in Chinese. This imposes a specific language/locale on users without indicating any choice or opt-in, which matches the language-policy violation category.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The generated HTML hard-codes
lang='zh-CN', which imposes a specific language/locale on all rendered reports. Under the policy, locale constraints should either be user-selectable or clearly documented as justified for a region-specific tool; this file provides neither in its natural-language strings or API.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module documentation states that API keys are only read from a local config.json, but the login command accepts --app-key on the command line and persists it. Command-line arguments are commonly exposed through shell history, process listings, audit logs, and agent telemetry, so this creates a credential exposure path that contradicts the documented security model and may cause users to handle secrets unsafely.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code emits natural-language messages in Chinese for size-limit failures, which forces a specific language on users. The file does not indicate that the skill is region-specific or provide any opt-in or fallback language behavior, so it conflicts with the language/locale policy criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The total-size validation failure text is presented only in Chinese, again enforcing a single language for user-visible behavior. No nearby comment, docstring, or file-level note justifies a region-specific restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This user-facing termination message is emitted only in Chinese, which is a natural-language policy concern when no opt-in or locale documentation is present. The code gives no indication that the skill is explicitly scoped to Chinese-language users.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The error message string is hard-coded in Chinese ("请求失败 HTTP ...") with no indication that the user can choose another language or locale. The policy requires avoiding forced language constraints unless the skill explicitly offers a language choice or clearly documents a justified locale restriction.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
python contract_snapshot, funcs, description, include_skillhub_auth=False, allow_remote_files=False, include_feedback=False, ):
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code returns user-facing status strings in Chinese for duration formatting and later composes progress messages entirely in Chinese. Because the file does not provide any user opt-in, language selection, or documented region-specific justification, it appears to force a specific locale in violation of the language-choice policy.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The main formatter builds all progress, status, and delivery text in Chinese, including queueing, completion, failure, and background-monitoring messages. There is no visible mechanism for user language preference, opt-in, or locale-aware formatting, so this is a natural-language policy issue rather than a code-security issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The platform reminder message is hard-coded in Chinese, and the file also contains Chinese-only status labels and report messages. This enforces a specific language for user-facing output without offering a language selection or documenting a justified locale restriction.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
Lines L30-L34 describe a completed-review billing flow, while L69 explicitly states the semantic review may not fully complete and results may be partial. This is a documentation-level intent inconsistency because the earlier section presents the operation as a straightforward completed review without that important qualification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The file contains only Chinese-language instructions and API documentation, with no indication that users can choose another language or that the Chinese-only scope is intentional and justified. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The raised error message is hard-coded in Chinese, which imposes a specific language on users without opt-in. This is a natural-language policy concern because the file does not provide a locale choice or document that the tool is intentionally limited to Chinese-speaking users.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This code performs filesystem writes for HTML and DOCX outputs, creating files in a user-specified directory. There is no confirmation prompt, warning message, or explicit disclosure near the write operations themselves, so users invoking this entrypoint may not be directly warned that files will be created or overwritten.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The command-line description and argument help strings are all written in Chinese, forcing a specific language for interactive CLI use. The file does not offer a language/locale option or justify a Chinese-only constraint, so this appears to violate the language-choice policy.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The only natural-language documentation in this file is written in Chinese and does not indicate that other languages are supported or that the locale is intentionally region-specific. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Confidence
- 50% confidence
- Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
- Content
python from zcm_lib import cli as _cli globals().update({name: getattr(_cli, name) for name in dir(_cli) if not name.startswith("__")}) if __name__ == "__main__":
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This helper constructs and sends HTTP requests, including optional raw data and JSON bodies, but the file provides no user-facing prompt, logging, or warning that request contents may be transmitted over the network. For code files, network calls that transmit user or system data should have some form of disclosure unless the warning is documented elsewhere or the behavior is clearly part of the skill's stated purpose, which is not established within this file alone.
- Content
Static analysis
Detected: suspicious.dynamic_code_execution
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- scripts/zcm_lib/reporting.py:59