废标风险检查-控标信号与限制条款识别

• Outcome: Review
• Latest audit: Jul 18, 2026 · 2:11 AM UTC
• Version: 1.0.3

Overview

This skill mostly matches bid-risk analysis, but it should be reviewed because it persists credentials, collects a MAC-derived device identifier for auto-registration, and exports shareable reports containing signed access links.

Review this skill before installing. It may be useful for procurement analysis, but you should only use it if you are comfortable with a vendor account flow, a locally stored API key, a MAC-derived device hash being sent during auto-registration, and reports that may contain signed links granting access to source records. Avoid sharing exported HTML reports outside trusted recipients unless those links are safe to disclose.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill explicitly describes local file read/write behavior (reading user-provided files and writing reports/config under the user's home directory) while the metadata only declares an environment variable requirement and no corresponding permissions. Undeclared filesystem access weakens user consent and platform enforcement, and could allow broader local data exposure or persistence than users expect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence
• Finding: The skill description frames the capability as bid-risk analysis, but the instructions add local report generation with HTML, embedded JavaScript, and file output. That mismatch matters because active HTML/JS artifacts and local file generation expand the attack surface beyond pure data analysis, creating risks of script-bearing outputs, user surprise, and unsafe handling of untrusted content from upstream APIs.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file instructs the agent to collect device fingerprints, perform account auto-registration, transmit hardware-derived identifiers to a remote service, and persist API keys locally. Those behaviors are unrelated to the stated bid-risk analysis purpose, expand the data-collection surface, and create a covert capability for user/environment tracking and credential provisioning inside a content-analysis skill.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The balance-exhaustion flow generates login links, nudges users toward phone binding, and embeds account lifecycle/marketing behavior that exceeds what is needed for bid-risk analysis. This creates unnecessary identity-linking pressure and increases the chance that a user is funneled into account actions they did not expect from the skill’s declared function.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The template explicitly instructs the agent to preserve and redistribute full signed `sk` URLs because they bypass login restrictions. That turns a bearer-style access token into a shareable artifact in user-visible output and exported reports, which can grant unintended access to underlying records to anyone who receives the link, and may leak into logs, chats, or downstream systems.

Context-Inappropriate Capability

Low

• Confidence: 81% confidence
• Finding: The skill directs default generation of an HTML file on the local filesystem and disclosure of its absolute path to the user. While not inherently a direct compromise, revealing host-specific absolute paths can disclose environmental details and encourage assumptions about local file persistence or accessibility, which is unnecessary and can become more sensitive in shared or multi-tenant runtimes.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The template mandates a default file-writing side effect and script execution after producing the Markdown report, without requiring explicit user consent at the time of action. Silent persistence of generated content can surprise users, create unauthorized data retention, and increase the chance that sensitive procurement analysis or embedded links are written to disk in environments where users did not intend storage.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The workflow explicitly instructs the agent to read a user-provided local bid file, but it does not require any user-facing consent, scope limitation, or warning about accessing local filesystem content. In an agent environment where local file tools may expose more than the intended document, this increases the risk of overbroad file access or accidental ingestion of sensitive local data.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.