Security audit

招标文件智能解读

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent bidding-document purpose, but it needs Review because its scripts can exceed the declared local file read/write boundaries.

Install only if you are comfortable uploading sensitive tender and bid files to the named vendor service under your Api Key. Confirm each file path before upload, avoid passing unrelated local paths, use a dedicated output folder, and watch for files created in both biaoshu-bailian-files and ~/.zcm.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:145
Finding: Mandatory Output and Instruction Hijacking Through Skill-Level Directives
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/zcm_lib/files.py:23
Finding: Arbitrary Readable Local Files Can Be Uploaded to the Remote API
Content: View full analysis
max_mb * 1024 * 1024: _die( f"{label} exceeds the size limit." ) def check_total_size(paths, max_mb, label): """Validate batch upload size; unreadable files are left to server-side checks.""" total = 0 for path in paths: try: total += os.path.getsize(path) except OSError: return if total > max_mb * 1024 * 1024: _die(f"{label} total size exceeds the limit.") def encode_multipart(fields, files): """Build a multipart/form-data request body from fields and local files.""" boundary = "----zcm" + uuid.uuid4().hex crlf = b"\r\n" buf = bytearray() for name, value in (fields or {}).items(): buf += b"--" + boundary.encode() + crlf buf += f'Content-Disposition: form-data; name="{name}"'.encode() + crlf + crlf buf += str(value).encode("utf-8") + crlf for field_name, filepath in files: if not os.path.isfile(filepath): _die(f"File does not exist: {filepath}") fname = os.path.basename(filepath) ctype = mimetypes.guess_type(fname)[0] or "application/octet-stream" with open(filepath, "rb") as f: content = f.read() buf += b"--" + boundary.encode() + crlf buf += ( f'Content-Disposition: form-data; name="{field_name}"; filename="{fname}"' ).encode("utf-8") + crlf buf += f"Content-Type: {ctype}".encode() + crlf + crlf buf += content + crlf buf += b"--" + boundary.encode() + b"--" + crlf ret ...[truncated 2212 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/zcm_lib/storage.py:62
Finding: Persistent State Is Written Outside the Declared Filesystem Boundary
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/report_lib/generator.py:12
Finding: Unrestricted Output Paths and Unsanitized Report Basenames Permit Arbitrary File Overwrite
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/zcm_lib/http_client.py:40
Finding: Authenticated HTTP Requests Do Not Enforce Redirect Origin Restrictions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (24)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
**升级 skill 必须保留配置**：如果当前已安装目录存在 `config.json`，升级时不得删除、覆盖或替换该文件；只能更新 `SKILL.md`、`scripts/`、`references/` 等 skill 内容文件。本地生成目录 `biaoshu-bailian-files/` 也必须保留。

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger conditions are extremely broad and include common conversational intents around bidding, document review, and drafting, increasing the chance the skill auto-activates on ambiguous requests. In this skill's context, unintended invocation is more dangerous because activation can lead to reading local files, writing outputs, and uploading sensitive commercial documents to a remote vendor service.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill declares that attachment URLs, file streams, and base64 data are not exfiltrated to third parties, but elsewhere explicitly states that user tender/bid files are uploaded to the vendor cloud for processing. This creates a material transparency and consent problem: users may rely on the denial language and provide sensitive procurement documents without understanding that off-device transfer occurs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: All user-facing instructions and required phrasing in this file are written exclusively in Chinese, including directives on how information should be presented to users. There is no indication that the skill supports user language selection or that the Chinese-only constraint is required for a region-specific compliance reason.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. The file presents all instructions and user-facing workflow guidance only in Chinese, with no indication that the skill offers multilingual support, user opt-in, or that it is intentionally limited to a Chinese-speaking/regional context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown file contains user-facing operational documentation only in Chinese, and there is no statement that the skill is region-specific or that users may choose another language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file describes billing-impacting behavior and explicitly says that before generation there is no insufficient-balance warning and no balance-blocking. Because the skill documentation covers actions that consume user credits, omitting or negating a user warning is a safety-relevant disclosure issue for markdown under the missing user warnings category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file instructs the assistant to present risk levels directly in Chinese, which imposes a specific language choice on user-facing output. There is no indication here that the user may choose another language or locale, nor that the constraint is justified as a region-specific language requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code hard-codes report titles, section headings, and labels in Chinese, and the pattern continues throughout the file. That creates a language/locale policy concern because users are not offered a language choice or opt-in, and no region-specific justification is documented in the file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The generated HTML hard-codes lang='zh-CN', which enforces a specific language/locale for all rendered reports. Under the policy, locale constraints should either be optional for the user or clearly documented as justified for a region-specific tool; this file provides no such opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file emits natural-language messages in Chinese in _die paths, which forces a specific language for user-visible output. The provided policy requires flagging language or locale constraints unless the skill offers user opt-in or clearly documents a justified regional limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This line presents a user-visible error entirely in Chinese, again imposing a fixed language choice. There is no indication in this file that the locale is configurable or that the restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file-not-found message is another user-facing string fixed to Chinese, which may violate organizational language-choice policy. No opt-in, fallback, or documented regional constraint is visible in this file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code emits multiple natural-language status and error messages in Chinese, and later continues that pattern throughout the file for user-visible output. Because the skill forces a specific language in its natural-language interaction without any opt-in or alternative locale handling, it violates the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · scripts/zcm_lib/parser.py (reported line 13)May include surrounding context.
python
contract_snapshot, funcs, description, include_skillhub_auth=False, allow_remote_files=False, include_feedback=False, ):

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code formats output using Chinese-only strings such as “分钟”, “小时”, and “天”, and later continues with Chinese-only progress messages. That forces a specific language/locale in user-visible output without any indication of user choice or documented region-specific scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file hard-codes Chinese translations for risk and priority values and later emits Chinese-only status messages. This indicates a fixed language choice in user-facing behavior without any visible configuration, opt-in, or documented locale justification in the file.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: L135 says generation does not perform balance-insufficiency warning or blocking before submission. But L161 states that before submission the script will precheck available balance, which is an active contradiction about whether pre-submission balance checks occur.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The workflow explicitly instructs the skill to download a generated file locally when the user asks for a local file, but it does not require an explicit confirmation or warning that the action will write to the user's filesystem. In an agent context, local file writes are sensitive because they can create unexpected artifacts, overwrite user expectations about where data is stored, and expand the consequences of prompt injection or accidental misuse.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The file explicitly states that when semantic review is incomplete or only a partial summary is available, callers must truthfully describe the output as partial. However, this file is purely API documentation and does not define any mechanism that enforces that requirement; the documented behavior still returns partial_summary and semantic-review status fields that downstream code could ignore. This creates an intent-behavior gap within the documentation itself about how results should be represented.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The only natural-language documentation in this file is entirely in Chinese, and the file does not indicate that language choice is optional or that the skill is region-specific. Under the stated policy, forcing a specific language without user opt-in can be a locale-policy violation.
Content: No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Confidence: 50% confidence
Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
Content: Scanner excerpt · scripts/zcm.py (reported line 10)May include surrounding context.
python
from zcm_lib import cli as _cli globals().update({name: getattr(_cli, name) for name in dir(_cli) if not name.startswith("__")}) if __name__ == "__main__":

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code emits a hard-coded Chinese message string ("请求失败 HTTP ...") for HTTP failures. This enforces a specific language in user-facing output without any visible opt-in or locale selection, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The --version string is hard-coded in Chinese, which imposes a specific language choice on all users of the CLI. The file does not offer any language selection or document this as a justified locale-specific constraint.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/zcm_lib/reporting.py:59