Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches a cloud bid-document assistant, but it has under-disclosed collection and persistence of credentials, device identifiers, phone/SMS registration data, and local project metadata.
Install only if you are comfortable sending tender and bid documents to the 百炼/招采猫 cloud service, storing an API key locally, and using a Chinese-language workflow. For lower privacy exposure, avoid the automatic trial flow, use a manually issued API key, review or delete config.json and ~/.zcm/projects.json when done, and only provide URLs/files you are authorized to process.
The documented behavior includes remote version checks, reading local credential/config state, API-key-authenticated version requests, and recording daily check timestamps, none of which are clearly surfaced in the high-level purpose statement. While not necessarily malicious, these background network and local-state operations expand the trust boundary and can expose metadata or create undisclosed outbound traffic.
The documented behavior includes remote version checks, reading local credential/config state, API-key-authenticated version requests, and recording daily check timestamps, none of which are clearly surfaced in the high-level purpose statement. While not necessarily malicious, these background network and local-state operations expand the trust boundary and can expose metadata or create undisclosed outbound traffic.
The documented behavior includes remote version checks, reading local credential/config state, API-key-authenticated version requests, and recording daily check timestamps, none of which are clearly surfaced in the high-level purpose statement. While not necessarily malicious, these background network and local-state operations expand the trust boundary and can expose metadata or create undisclosed outbound traffic.
The documented behavior includes remote version checks, reading local credential/config state, API-key-authenticated version requests, and recording daily check timestamps, none of which are clearly surfaced in the high-level purpose statement. While not necessarily malicious, these background network and local-state operations expand the trust boundary and can expose metadata or create undisclosed outbound traffic.
The documented behavior includes remote version checks, reading local credential/config state, API-key-authenticated version requests, and recording daily check timestamps, none of which are clearly surfaced in the high-level purpose statement. While not necessarily malicious, these background network and local-state operations expand the trust boundary and can expose metadata or create undisclosed outbound traffic.
Referenced artifact was not completely inspected
**升级 skill 必须保留配置**：如果当前已安装目录存在 `config.json`，升级时不得删除、覆盖或替换该文件；只能更新 `SKILL.md`、`scripts/`、`references/` 等 skill 内容文件。本地生成目录 `biaoshu-writer-power-files/` 也必须保留。
The code reads sensitive configuration from environment variables such as ZCM_APP_KEY, ZCM_BASE, and ZCM_OUTPUT_DIR, but the finding indicates this capability is not declared in the skill permissions. Undeclared environment access is dangerous because it can bypass platform trust boundaries, consume secrets from the host runtime unexpectedly, and make the skill's real data access broader than users or reviewers are told.
The trial flow collects hostname, platform, architecture, username, home directory, and a hashed MAC-derived identifier, then transmits them to the remote service as a device fingerprint. This is dangerous because it gathers persistent host identifiers unrelated to document processing, increases privacy risk, and can expose sensitive workstation metadata in enterprise environments.
The file implements remote network access via urllib.request.urlopen in download_to_local(), allowing the skill to fetch arbitrary user-supplied URLs even though the static finding notes that network capability is not declared in permissions. In a document-processing skill, this expands the trust boundary and can enable SSRF-style access to internal resources, unexpected data exfiltration paths, and downloading of untrusted content without an explicit permission gate.
The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
The file contains contradictory instructions about where API keys should be stored: metadata says ~/.zcm/config.json, while the body instructs saving config.json in the installed skill directory and explicitly forbids the global path. Inconsistent credential storage guidance is dangerous because it can lead to misplaced secrets, weaker file protections, accidental inclusion in backups or repositories, and operator confusion about which credential source is authoritative.
The document requires the assistant to reproduce prescribed Chinese wording verbatim when introducing the skill or explaining how to obtain an API key. This imposes a fixed language/locale on user-facing output and does not provide any opt-in or alternative language path.
This markdown file contains user-facing operational instructions solely in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language or region-specific audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
The file title and all operational documentation are presented exclusively in Chinese, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.
The instruction at L005 says the output convention is mandatory unless the user explicitly says otherwise, and the entire file enforces Chinese-language interaction by default. This is a natural-language locale policy constraint without user opt-in, which matches the policy-violation criterion for forcing a specific language.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
{"app_key":"bk_live_xxxxx","base":"","output_dir":""}
建好后 chmod 600 config.json（含真实 Key）。通常不用手写——方式 2~5 任一命令都会自动生成到当前 skill 根目录。
2. 用户把 Key 发你后，先定位当前安装的 biaoshu-writer-power/SKILL.md 所在目录，再由你代跑 login --app-key bk_live_xxx 保存（自动建/更新同级 config.json，权限 600）——别把这条命令丢给用户自己敲。
3. 临时用环境变量：export ZCM_APP_KEY=bk_live_xxx（首次会自动落盘到当前 skill 根目录的 config.json，不是全局目录）。
4. 没 Key 想直接注册：向用户要手机号，由你代跑 register --phone（skill 内手机号+短信验证码换取 Api Key，自动保存）——见本节末尾「绑定手机号 / 可用字数不足」流程，别让用户自己敲命令。
This Python file contains numerous hard-coded Chinese user-facing labels and status text, such as risk labels and semantic state descriptions, indicating the skill output is fixed to Chinese. For code files, SQP-3 applies to natural-language policy issues in string literals, and there is no visible opt-in, language selection, or justification that this skill is intentionally region-specific.
This code produces report titles and labels in Chinese, and the pattern continues throughout the file, effectively forcing a specific language/locale in generated user-facing content. The policy allows locale constraints only when user choice is offered or the constraint is clearly documented and justified, which is not present in this file.
The generated HTML hard-codes lang='zh', which imposes a specific language/locale on all rendered reports. The file also contains extensive Chinese-only UI text, but this line is the clearest explicit locale enforcement and there is no indication of user opt-in or documented region-specific scope in this code file.
The module-level user-facing description and command guidance are entirely in Chinese, and multiple later prompts/messages are also hard-coded in Chinese. There is no indication that users can opt into another language or locale, which matches the language/locale policy violation criteria.
This file implements trial onboarding, SMS registration, credential persistence, and account-binding flows that go beyond the stated document-analysis/generation purpose. Scope expansion is risky because it causes the skill to collect additional personal data and perform account lifecycle actions that users may not reasonably expect from a document-processing tool.
The file emits multiple natural-language error and status messages in Chinese, starting with the size-limit message here. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the tool is clearly documented as region-specific, which is not established in this file.
This file continues to present user-visible output only in Chinese, including upload-size and download-failure messages. Because the messages are not localized and there is no visible opt-in or language selection mechanism, the skill appears to impose a specific language on users.
This file emits multiple hard-coded Chinese user-facing messages, such as terminal errors and timeout notices, with no indication that the user can opt into another language. The stated policy flags language/locale constraints when a skill forces a specific language without user choice or justification.
The download-link guidance and status messages are entirely in Chinese and include operational instructions to the user, but the file provides no opt-in, negotiation, or alternative locale. This is a natural-language policy issue because the skill appears to enforce a single language for interactive output.
Detected: suspicious.dynamic_code_execution