T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:143- Finding
Mandatory Agent Output Hijacking Through Skill Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
标书自动撰写工具
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent bid-document workflow, but it needs review because it handles sensitive cloud uploads and billing while also over-controlling user-facing output and writing outside its declared local boundary.
Install only if you are comfortable uploading sensitive tender and bid files to this vendor's cloud service and using an account Api Key that may incur word-balance charges. Use a dedicated key, keep config.json private, confirm each upload and paid generation step, avoid untrusted custom report basenames/output paths, and be aware the skill may leave project metadata in ~/.zcm/projects.json.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/report_lib/generator.py:20- Finding
Path Traversal in Report Basename Allows Writes Outside the Output Directory
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/zcm_lib/storage.py:62- Finding
Undeclared Persistent Writes to the User Home Directory
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (26)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md **升级 skill 必须保留配置**：如果当前已安装目录存在 `config.json`，升级时不得删除、覆盖或替换该文件；只能更新 `SKILL.md`、`scripts/`、`references/` 等 skill 内容文件。本地生成目录 `biaoshu-bailian-files/` 也必须保留。
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill description uses very broad natural-language triggers such as generic questions about bidding, document review, or similarity checks, which could cause the agent to invoke the skill when the user did not intend to upload sensitive procurement files to a third-party service. In this skill's context, unintended invocation is more dangerous because the workflow explicitly sends tender/bid documents to a remote server and may also incur billing on the user's API key.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The initial skill description advertises handling tender/bid files but does not immediately warn that those files are uploaded to an external server, even though later sections disclose remote processing. This is dangerous because users may provide highly sensitive commercial, pricing, or personal-information documents without informed consent at the point of invocation, leading to unintended third-party disclosure.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
L161 says generation will pre-check available balance before submission, but L135 explicitly states generation does not warn about insufficient balance before starting and does not block on balance, and L103 further describes failures only if the backend later stops for insufficient balance. These statements conflict about whether a balance check gates or warns before submission.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The instruction says long-task fields must be relayed to the user, and the entire file prescribes Chinese user-facing phrasing such as "生成内容" and "正在写正文" without offering any language choice. This can violate a language/locale policy when users have not explicitly opted into Chinese output.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document title and all operational instructions are written in Chinese, with no indication that the skill supports other languages or that Chinese is an intentional, justified regional limitation. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This file’s user-facing instructions and API usage guidance are exclusively in Chinese, and there is no indication that users may choose another language or that the skill is restricted to a Chinese-language context. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code generates report titles and labels in Chinese, and similar hard-coded Chinese strings appear throughout the renderer. That enforces a specific language/locale in user-facing output without any visible mechanism for user choice or documented locale justification, which matches the language-policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Multiple user-visible strings such as headings, labels, badges, and footer text are embedded only in Chinese, indicating the skill produces reports in a fixed language. This constitutes a natural-language policy concern because the implementation does not expose any language choice or opt-in mechanism within the file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The generated HTML document sets
lang='zh-CN'unconditionally, which forces a specific language/locale in the output. The policy for this audit flags language or locale constraints when they are imposed without user opt-in or a clearly documented justification in the file.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file emits natural-language messages such as size-limit and retry guidance exclusively in Chinese. This creates a language policy concern because the skill forces a specific locale without user opt-in, and no justification for a Chinese-only audience appears in this file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The error message string
请求失败 HTTP ...is hardcoded in Chinese, which imposes a specific language in user-facing output. The file does not show any opt-in, locale selection, or documentation that this skill is intentionally limited to Chinese-speaking users or a Chinese locale.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This Python file contains multiple hard-coded Chinese user-facing strings, starting with the error messages at L33-L36 and continuing throughout the command output paths. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
python contract_snapshot, funcs, description, include_skillhub_auth=False, allow_remote_files=False, include_feedback=False, ):
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The helper returns Chinese-only natural-language duration strings such as "分钟", "小时", and "天". This is a language/locale policy issue because the code enforces a specific output language without offering a user choice or documenting a justified locale constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The function builds all status text in Chinese, including stage descriptions and completion updates like "任务已提交，正在排队" and "我会继续后台监听，完成后交付成品链接". Because these are natural-language outputs with no configurable language path, the skill appears to force a single language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file hardcodes Chinese translations for risk and priority enums and later emits Chinese-only user-facing log messages. This creates a natural-language locale policy issue because the skill enforces a specific language without any visible user opt-in or documented justification in this file.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
该文件的自然语言内容完全以中文呈现，且未说明这是仅面向中文用户的区域性文档，也未提供其他语言或用户选择机制。根据语言/locale 政策，若未明确提供用户选择或正当的地区限定，强制单一语言可能构成自然语言政策问题。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The raised error message is hard-coded in Chinese, which imposes a specific language on users without any opt-in or locale selection. This is a natural-language policy concern because the file does not provide an alternative language path or document a justified locale restriction.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This code writes generated HTML and DOCX reports to the filesystem, but there is no confirmation prompt, warning message, or explanatory comment/docstring indicating that user-provided report content will be saved to disk. Because file creation can affect user data and system state, the operation should be disclosed somewhere visible to the user.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The command-line description and argument help strings are entirely in Chinese, which forces a specific language for all users. No user choice, locale detection, or documentation of a China-only/regional scope appears in this file.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The only user-facing natural-language text in this file is written in Chinese, and there is no indication that language selection is optional or that the tool is intentionally restricted to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation.
- Content
Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Confidence
- 50% confidence
- Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
- Content
python from zcm_lib import cli as _cli globals().update({name: getattr(_cli, name) for name in dir(_cli) if not name.startswith("__")}) if __name__ == "__main__":
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The function returns user-facing status text entirely in Chinese, which imposes a specific language choice in natural-language output. There is no indication here that the user can choose a locale or that the skill is explicitly limited to a Chinese-language context.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This code sends outbound HTTP requests and may transmit request headers and payload data via
urlopen, but the file contains no confirmation prompt, user-facing log/print, or warning comment/docstring about that transmission. For code files, outbound network operations can warrant disclosure unless such warning is provided elsewhere or is clearly covered by the skill's stated purpose, which is not evident from this file alone.- Content
Static analysis
Detected: suspicious.dynamic_code_execution
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- scripts/zcm_lib/reporting.py:59