Security audit

Bid Collection

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed public procurement lead-monitoring helper with bounded network use, local output, and user-confirmed scheduling behavior.

Install only if you are comfortable with a skill that searches public procurement websites and can create a scheduled monitor after confirmation. Review custom sources carefully, avoid internal or untrusted URLs, and stop the monitor when no longer needed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Cloud Metadata Access

High

Category: Server-Side Request Forgery
Confidence: 90% confidence
Finding: Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.
Content: Scanner excerpt · SKILL.md (reported line 230)May include surrounding context.
md
> ⚠️ **安全警告（执行前必须告知用户并获得确认）**：`add-source <url>` 会使本技能在后续 scan/monitor 中向该 URL 发起出站 WebSearch/WebFetch 请求并抓取其内容。 > - **仅添加您信任的公开招投标信息平台**； > - 添加不可信来源可能导致：向攻击者可控主机发起请求（SSRF 类风险）、技能处理来自不可信源的恶意/误导性内容、向非预期第三方暴露扫描关键词（搜索请求会附带查询参数）； > - 添加内网/本地/元数据地址（如 `127.0.0.1`、`169.254.169.254`、`localhost`、内网段）会被拒绝。 > > 执行前请向用户复述上述风险并询问"确认添加？"，用户明确确认后才写入监控源清单。

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest description and trigger guidance are written as Chinese-only usage instructions, including explicit 'Use when the user asks for ...' phrasing tied to Chinese terms. There is no indication that users may choose another language or locale, which can violate language-choice policy for general-purpose skills.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The description begins with Chinese text and presents the skill branding in a fixed Chinese/English form, but this manifest provides no indication that language selection is optional or user-configurable. Under the policy rule for natural-language violations, fixed locale/language behavior should be documented as opt-in or justified when a skill may be used broadly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The detection keyword tables include untranslated Chinese terms such as "procurement意向" and "competitive磋商" alongside English phrases, implying a locale-specific language expectation. Because the document does not state that it is limited to Chinese procurement contexts or offer a language/locale option, this can be interpreted as forcing a specific locale without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This markdown file uses a single language/locale presentation for a region-specific monitoring source list and includes usage guidance, but does not indicate whether users may choose another language. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.