Security audit
Security checks for vulnerabilities and agentic risk
This skill mostly does what it claims, but it has under-disclosed privacy and credential-handling issues around device data, phone verification, cloud document uploads, URL downloads, and where API keys are stored.
Review before installing. Use a manual API key if possible, avoid automatic trial provisioning if you do not want device characteristics sent, and do not upload confidential tender, bid, personal, or regulated documents unless you are authorized to send them to the vendor cloud. Check where config.json will be stored and remove it on logout or uninstall if needed.
The skill description emphasizes document-processing features, but the instructions also describe collecting device characteristics for automatic trial-account creation and sending user-derived experience/feedback back to the platform. Those extra data flows expand the privacy and trust boundary beyond what many users would reasonably expect from a bidding-document tool.
The skill description emphasizes document-processing features, but the instructions also describe collecting device characteristics for automatic trial-account creation and sending user-derived experience/feedback back to the platform. Those extra data flows expand the privacy and trust boundary beyond what many users would reasonably expect from a bidding-document tool.
The skill description emphasizes document-processing features, but the instructions also describe collecting device characteristics for automatic trial-account creation and sending user-derived experience/feedback back to the platform. Those extra data flows expand the privacy and trust boundary beyond what many users would reasonably expect from a bidding-document tool.
The skill description emphasizes document-processing features, but the instructions also describe collecting device characteristics for automatic trial-account creation and sending user-derived experience/feedback back to the platform. Those extra data flows expand the privacy and trust boundary beyond what many users would reasonably expect from a bidding-document tool.
The skill description emphasizes document-processing features, but the instructions also describe collecting device characteristics for automatic trial-account creation and sending user-derived experience/feedback back to the platform. Those extra data flows expand the privacy and trust boundary beyond what many users would reasonably expect from a bidding-document tool.
The skill description emphasizes document-processing features, but the instructions also describe collecting device characteristics for automatic trial-account creation and sending user-derived experience/feedback back to the platform. Those extra data flows expand the privacy and trust boundary beyond what many users would reasonably expect from a bidding-document tool.
Referenced artifact was not completely inspected
**升级 skill 必须保留配置**：如果当前已安装目录存在 `config.json`，升级时不得删除、覆盖或替换该文件；只能更新 `SKILL.md`、`scripts/`、`references/` 等 skill 内容文件。本地生成目录 `biaoshu-writer-edu-files/` 也必须保留。
The CLI reads sensitive configuration from environment variables such as ZCM_APP_KEY and ZCM_BASE, but the finding indicates this capability is not declared in the skill permissions. Undeclared environment access is dangerous because it can silently consume host secrets or alter network destinations, especially since ZCM_BASE can redirect authenticated API traffic to an attacker-controlled endpoint.
The file performs outbound network access via urllib.request.urlopen in download_to_local(), but the declared permissions apparently do not cover network capability. In this skill, that is significant because it can fetch arbitrary user-supplied URLs and transfer external content into local processing, creating SSRF-style exposure and unexpected data-flow to internal or restricted endpoints if permission boundaries are not explicit.
The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
The manifest declares credential storage in ~/.zcm/config.json, but the instructions require writing config.json in the skill installation directory instead. Conflicting credential-storage rules create a real risk of secrets being written to an unintended, less protected, or more broadly accessible location, especially if the install directory is shared, synced, or version-controlled.
The manifest says phone number and verification code are 'not collected,' yet later instructions direct the assistant to guide or handle phone/SMS-based verification flows. This contradiction can mislead users and reviewers about sensitive personal-data handling, undermining informed consent and creating privacy/compliance risk.
The skill describes automatic trial-account creation with device-feature collection but does not present a clear user-facing privacy warning or opt-in at the point of collection. Because device fingerprinting can be persistent and identifying, collecting it silently or by default meaningfully increases privacy risk in a document-processing context where users may expect only file upload and API-key use.
These lines require the assistant to reproduce specific Chinese-language API-key and feature description content verbatim when introducing the skill. This effectively forces a specific language/locale for user-facing responses, and the file does not offer an opt-in or alternative language choice.
The file is entirely written as mandatory operational guidance in Chinese and includes user-facing phrasing requirements such as '展示给用户时统一说“可用字数”' and '必须把...转述给用户', but it does not provide any user opt-in or alternative locale. This creates a natural-language locale policy concern because the skill appears to enforce a specific language for user communications without documented choice or region-specific justification.
The title and entire skill specification are written as a Chinese-only interface contract, and there is no indication that users may choose another language or locale. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is explicitly documented and justified.
The documentation instructs users to upload bid files and retrieve compliance-review results, but it does not clearly warn that these files may contain highly sensitive commercial, legal, personal, or procurement data that will be transmitted to and processed by a cloud platform. In this skill context, the risk is elevated because tender and bid documents often include proprietary pricing, identity materials, seals, certificates, and competitive strategy, so omission of a privacy/data-handling warning can lead users to disclose sensitive information without informed consent.
This API documentation instructs users to upload 2-3 bid files and an optional tender file to a cloud service, but it does not clearly warn about the confidentiality, privacy, and data-governance risks of sending commercially sensitive procurement documents off-platform. In this context, the omission is material because bid/tender files commonly contain trade secrets, pricing, identities, and metadata; without an explicit user-facing warning, users may disclose sensitive third-party or regulated data without fully understanding retention, access, or processing implications.
The document states that uploaded files and task results are retained on the vendor's servers for about 7 days, but it does not clearly require user-facing notice, consent, or data-minimization guidance before sensitive bid materials are sent off-platform. Because this skill handles procurement and tender documents that may contain confidential business, pricing, and identity data, insufficient privacy warning increases the risk of unintended disclosure or non-compliant data handling.
The entire document is written as mandatory operational guidance in Chinese, with no indication that other languages are supported or that the user can opt into this locale. Under the policy, forcing a specific language without user choice can be a natural-language policy violation unless the locale restriction is explicitly justified.
The file title and the surrounding operational instructions are written as mandatory Chinese-language guidance, and no line offers the user a language or locale choice. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
{"app_key":"bk_live_xxxxx","base":"","output_dir":""}
建好后 chmod 600 config.json（含真实 Key）。通常不用手写——方式 2~5 任一命令都会自动生成到当前 skill 根目录。
2. 用户把 Key 发你后，先定位当前安装的 biaoshu-writer-edu/SKILL.md 所在目录，再由你代跑 login --app-key bk_live_xxx 保存（自动建/更新同级 config.json，权限 600）——别把这条命令丢给用户自己敲。
3. 临时用环境变量：export ZCM_APP_KEY=bk_live_xxx（首次会自动落盘到当前 skill 根目录的 config.json，不是全局目录）。
4. 没 Key 想直接注册：向用户要手机号，由你代跑 register --phone（skill 内手机号+短信验证码换取 Api Key，自动保存）——见本节末尾「绑定手机号 / 可用字数不足」流程，别让用户自己敲命令。
The documented trial flow states that device fingerprint data is automatically collected to provision a trial account. Device fingerprinting is privacy-sensitive tracking data, and the documentation does not show clear user notice, consent, minimization, retention limits, or a necessity justification tied to bid-document generation. In a document-processing skill, this creates an unnecessary data-collection surface and potential compliance risk.
The knowledge-base commands expose retrieval of enterprise profile, qualifications, performances, and financial reports, which expands the skill beyond its stated bid-writing and review workflow. This kind of scope expansion increases the chance of unauthorized access to sensitive business data and violates least-privilege expectations if users are not clearly informed that such data access exists.
The documentation includes backend submission of user experience data and feedback, which is unrelated to the core bid-document service and creates an additional exfiltration path for user-provided content. Because the content may include project details, corrections, or preferences, sending it to a backend without narrow scoping and explicit consent can leak sensitive procurement information.