中文项目申请书写作与交付

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 1.0.1

Overview

This skill is a coherent Chinese grant-proposal writing helper that creates draft Word documents and checklists, with no hidden payload found; the main caution is its unpinned npx install command.

Install only from a source and revision you trust, preferably pinned to a reviewed version or commit, and avoid running the npx command with administrator privileges. Provide only proposal materials needed for the task, treat generated .docx files as drafts, and have the applicant or institution verify facts, budget, ethics, attachments, and current funder rules before submission.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:9

Finding

Unpinned npx Installation Command Executes Mutable Third-Party Code

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 9–11
Vulnerability Type: Unpinned third-party package and mutable Skill source
Risk Level: Medium

Vulnerable Code

bash

npx skills add ECNU-ICALK/zh-project-proposal-writing-skill

Technical Analysis

The documented installation command invokes the skills npm package through npx without pinning it to an exact, reviewed version. If that package is not already available locally, npx may download and execute the currently resolved package version with the invoking user's privileges.

The referenced Skill repository is also identified by a mutable repository name rather than an immutable commit, signed release, or verified artifact. Therefore, the content installed in the future may differ from the content reviewed during this audit.

No evidence shows that the current npm package or repository is malicious. The vulnerability is the absence of controls ensuring that users execute the same dependency and Skill revision that were reviewed.

Attack Path

1. An attacker compromises the npm package, its publisher account, the package-resolution path, or the referenced repository.
2. The attacker publishes a malicious package version or modifies the mutable Skill source.
3. A user follows the installation command from README.md.
4. npx resolves and may download the compromised skills package.
5. The package executes during installation with the user's permissions and retrieves or installs the mutable repository content.
6. The attacker-controlled code or Skill instructions execute outside the scope of the audited artifact.

This path requires compromise or malicious modification of an external dependency or source. The audited repository itself contains no embedded payload that performs these steps.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the privileges of the user running the installation command. Depending on that us ...[truncated 534 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI package to an exact reviewed version:

   bash

   npx --yes skills@<exact-reviewed-version> add ECNU-ICALK/zh-project-proposal-writing-skill
   

2. Pin the Skill source to an immutable commit hash or signed release if the installer supports that syntax.

3. Publish checksums or cryptographic signatures for release artifacts and document how users should verify them before installation.

4. Document the expected npm publisher, canonical repository, and reviewed release identifier so users can detect typosquatting or source substitution.

5. Use a lockfile-backed or otherwise reproducible installation process where possible.

6. Recommend installation from a non-privileged account and avoid running the command with administrator or root permissions.

7. Review each dependency update before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to run npx skills add ECNU-ICALK/zh-project-proposal-writing-skill without pinning a specific version or commit. This can cause consumers to fetch and execute whatever package state is current at install time, creating supply-chain risk if the upstream package is compromised, replaced, or unexpectedly changed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description is expansive and lacks precise invocation boundaries, which can make the orchestrator select this skill for loosely related requests. Because the skill includes advanced behaviors like guide interpretation, compliance handling, expert synthesis, and final Word document delivery, accidental activation could expose sensitive user data to unnecessary processing or cause the agent to exceed the user’s intended scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill’s activation scope is very broad, covering drafting, revising, diagnosing, structuring, review simulation, and final delivery for many proposal types. In an agentic environment, such breadth can cause the skill to trigger on ordinary writing requests and then assume control of tasks involving external materials, compliance interpretation, and document generation, increasing the chance of overreach, unintended tool use, or mishandling sensitive proposal content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The entire workflow is written as prescriptive Chinese-language guidance and does not indicate that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The title and entire document are written in Chinese, and the file does not indicate that language selection is optional or limited to a justified region-specific use case. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document title and all instructional content are written entirely in Chinese, with no indication that users may choose another language or that the skill is limited to a Chinese-language workflow. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document title and all operative instructions are written in Chinese, presenting the skill content as implicitly Chinese-only guidance. There is no visible statement that users may choose another language or locale, which can violate a language/locale policy requiring user opt-in rather than a forced default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The instruction requires clearly marked placeholders such as 待补充 and 需申请人核验, which imposes Chinese-language output conventions. This is a natural-language policy concern because the file does not offer a language choice or indicate that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This markdown file instructs the skill to write project materials into a Word document and only return the file path, but it does not include any warning that the skill will create or modify files on the user's behalf. Under the markdown-specific SQP-2 criteria, file-affecting behavior should be disclosed to users when describing the skill's behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 74% confidence

Finding

This section specifies that the skill should output a Word .docx delivery package, which affects user files, but the description does not warn about that behavior or its scope. The omission is relevant for markdown skill descriptions because users should be informed of actions that may affect their data or filesystem.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This file presents all operational guidance in a single language without stating that the skill is Chinese-only or offering any language/locale opt-in. Under the policy, forcing a specific language without user choice can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The prompt says '生成十个中文标题', which imposes a specific language requirement in natural-language instructions. Under the policy, forcing a language or locale without offering user choice can be a violation unless clearly justified; this file does not state such a justification or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The line '提供可直接粘贴的中文段落' requires output in Chinese and does not indicate that the user may choose another language. This is a natural-language locale constraint that should either be optional or explicitly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.