ClawHub
Back to skill

Security audit

标书自动撰写工具

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly coherent cloud bidding assistant, but it needs Review because it handles sensitive business documents and a full account API key while also forcing promotional output and writing local metadata outside its stated boundary.

Install only if you are comfortable uploading tender and bid documents to the vendor service, storing an API key locally, and using paid account word balance. Before use, confirm the output and state directories, avoid sharing the API key in chat, and treat the channel-coded signup/recharge links and fixed branding as vendor-controlled promotional material.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:139
Finding

Mandatory Promotional Output and Skill Instruction-Priority Hijacking

Content
View full analysis
" "\u672c\u62a5\u544a\u7531\u300c\u767e\u70bc\u00ae\u6807\u4e66\u300dskill\u81ea\u52a8\u751f\u6210" "" ) ``` ### Technical Analysis The Skill attempts to establish its own user-output rules as the highest-priority instructions and states that they override the remainder of the Skill documentation. It then mandates extensive onboarding, promotional content, a channel-coded platform URL, and fixed report branding. A Skill may describe its workflow, but it should not attempt to redefine instruction priority or force commercially influenced material into unrelated or general user responses. This behavior alters the agent's response policy when the Skill is loaded and can displace the user's immediate communication goals. The fixed `ch=c666` parameter also allows ...[truncated 1364 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/zcm_lib/storage.py:62
Finding

Local Metadata Reads and Writes Exceed the Declared Filesystem Boundary

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/zcm_lib/http_client.py:40
Finding

API Credential Can Be Forwarded to a Cross-Origin Redirect Target

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (26)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md
**升级 skill 必须保留配置**：如果当前已安装目录存在 `config.json`，升级时不得删除、覆盖或替换该文件；只能更新 `SKILL.md`、`scripts/`、`references/` 等 skill 内容文件。本地生成目录 `biaoshu-bailian-files/` 也必须保留。

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

All user-facing instructions and required status relay text are specified only in Chinese, including the directive to paraphrase progress updates to users. There is no opt-in, fallback, or documented region-specific justification for restricting the skill to Chinese, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The file title and all user-facing documentation are exclusively in Chinese, with no indication that users can choose another language or that the skill is intentionally restricted to a Chinese-only audience. Per the policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The entire skill documentation is written as a Chinese-only interface and includes prescriptive user-facing phrasing at L69 and L76, but nowhere offers language selection or states that the skill is intentionally limited to a Chinese-language/regional context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown describes a privacy- and data-handling-impacting behavior: uploaded files and results are stored on the vendor's server and persist for about 7 days. While the retention fact is stated, it is presented as a neutral convention rather than a clear warning or caution to users about remote storage and retention of their data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The entire skill guidance is written exclusively in Chinese and provides operational instructions only in that language. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified, which is not stated in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The markdown explicitly instructs the agent to present output in Chinese by stating that script output and reports have already been converted to Chinese and should be presented directly in Chinese. This imposes a language choice on users without indicating that they may choose another language or opt in to Chinese output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The raised error message is written only in Chinese, which imposes a specific language on users without opt-in. This is a natural-language policy concern because the file does not offer any locale selection or document that the tool is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The command-line description and argument help text are presented only in Chinese, which forces a specific language for all users. No alternative language, locale selection, or documented regional limitation is present in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code hardcodes report titles and section content in Chinese, beginning with the report name at L040 and continuing throughout the renderer. That creates a natural-language locale policy issue because the skill appears to force a specific language rather than offering a user-selectable language or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The rendered HTML hard-codes lang='zh-CN', which imposes a specific locale on all generated reports. This is a natural-language policy concern because the file does not offer user opt-in or any configurable language/locale selection, and no region-specific justification is present in this code.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The function constructs user-facing messages entirely in Chinese (e.g. '预计/本次需要约' and '当前可用') with no indication that the user can choose a language or that the skill is restricted to a Chinese-language context. This can violate language/locale policy when a skill imposes a specific language by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The error text emitted by the skill is written only in Chinese, which imposes a specific language on users without any opt-in or configuration path. This matches the language/locale policy violation category because the file contains natural-language strings that force one locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The string literal "请求失败 HTTP ..." hardcodes Chinese for a user-visible error message, which imposes a specific language without any opt-in or documented regional constraint in this file. SQP-3 applies to all file types and flags language/locale policy violations when a skill forces a language choice on users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code emits multiple user-facing status and error messages entirely in Chinese, and the same pattern continues throughout the file. Because the skill does not offer language selection or explain that it is intentionally China/Chinese-specific, it violates the language/locale policy for natural-language behavior.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/zcm_lib/parser.py (reported line 13)May include surrounding context.

python
contract_snapshot,
    funcs,
    description,
    include_skillhub_auth=False,
    allow_remote_files=False,
    include_feedback=False,
):

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This file formats all user-facing progress text in Chinese, including time units and status messages, without any visible mechanism for language selection or opt-in. The policy specifically calls for flagging skills that force a specific language or locale when no choice is offered.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file hard-codes Chinese translations for risk and priority values and later emits Chinese-only user-facing messages. This creates a natural-language locale constraint without any visible mechanism for user choice or documented justification in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The platform reminder and subsequent status messages in this file are presented only in Chinese, which enforces a specific language for users regardless of preference. Under the policy, language constraints should be optional or clearly justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
55% confidence
Finding

This file is primarily API documentation for launching and retrieving compliance reviews, but L69 introduces a behavioral requirement about how downstream consumers must present incomplete results. That is not a direct contradiction in code, and because there is no executable code here, the divergence signal is weak; however, it does mix API description with output-handling intent in a way that could mislead implementers about the file's scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file contains user-facing instructions and API documentation exclusively in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

All user-facing natural-language instructions in this file are written in Chinese, with no indication that other languages are supported or that Chinese is a justified regional requirement. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The only user-facing natural-language text in this file is written in Chinese, and there is no indication that language selection is optional or justified by a region-specific requirement. Per the policy, forcing a specific language without user opt-in can be a locale-policy violation.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/zcm.py (reported line 10)May include surrounding context.

python
from zcm_lib import cli as _cli

globals().update({name: getattr(_cli, name) for name in dir(_cli) if not name.startswith("__")})


if __name__ == "__main__":

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This code file defines a generic HTTP client that sends requests to arbitrary URLs and may transmit request headers and body data, but the file contains no user-facing warning, confirmation, or comment disclosing that network transmission occurs. For SQP-2 on code files, network/HTTP calls that transmit user or system data should have some visible disclosure unless the warning is provided elsewhere or the behavior is clearly covered by the skill description.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/zcm_lib/reporting.py:59