gov-procurement-analyst

• Outcome: Review
• Latest audit: Aug 24, 2026 · 12:34 PM UTC
• Version: 5.1.0

Overview

This procurement-analysis skill is useful but needs Review because it can crawl websites, persist sensitive business data, run scheduled monitoring and pushes, and hot-update itself through a PowerShell script.

Install only if you are comfortable with a procurement assistant that stores business and bid data locally, crawls public procurement sites, and may run scheduled competitor monitoring. Before using it with real company data, disable or closely review webhook pushes, avoid the PowerShell hot-update path unless the source is verified, and confirm where saved profiles, reports, and SQLite databases can be deleted.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill documents network access, file reads, and file writes, but the metadata does not declare permissions or clearly scope those capabilities. Hidden or undeclared capabilities weaken user consent and platform enforcement, especially for a skill that persists enterprise data locally and performs automated collection.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill includes a self-update flow that pulls and executes a remote PowerShell script (`tongyifabu.ps1`) for hot updates. Remote script execution creates a direct supply-chain and code-execution path: if the update source, transport, or script is tampered with, the host running the skill can be fully compromised.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The documentation promises enterprise data remains local and is never uploaded, yet elsewhere advertises outbound webhook integrations to WeCom/DingTalk for pushes. That contradiction can mislead users about data flows and cause sensitive project or enterprise details to be transmitted off-host without informed consent.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The script claims it 'strictly complies with robots.txt' in its exported compliance note, but that statement is stronger than what the implementation can guarantee in all cases. If robots.txt parsing, caching, redirects, or later request behavior diverge from policy, operators may rely on an inaccurate compliance assertion, creating legal/compliance risk and misleading downstream users or auditors.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger phrase set includes very broad terms such as '政府采购' and '采购公告', which are common in ordinary conversation and can cause unintended auto-activation of the skill. Because the skill can perform data collection, enterprise profiling, and bid-analysis workflows, accidental invocation could expose user data to the wrong tool, create confusing actions, or launch unnecessary scraping/processing without clear user intent.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: Many listed triggers are ambiguous in isolation, including phrases like '报价多少', '中标概率', '配额', '仪表盘', and '精确模式', which can appear in unrelated contexts. In an agent environment, such ambiguous triggers increase the chance of the procurement skill intercepting requests not meant for it, leading to misrouting, unintended processing of sensitive business data, or execution of workflows such as competitor profiling and compliance analysis without sufficiently specific consent.

Vague Triggers

Medium

• Confidence: 70% confidence
• Finding: Very broad trigger phrases increase the chance of unintended activation of powerful behaviors like web collection, local persistence, or document processing. In a skill with network and file capabilities, accidental invocation can expose data, create unwanted records, or start external requests without clear user intent.

Vague Triggers

High

• Confidence: 88% confidence
• Finding: Generic triggers such as '分析一下', '查一下', '最新', and '风险' are highly ambiguous and can map everyday speech to sensitive operations. Because this skill can read/write files, store enterprise data, and perform network tasks, ambiguous activation materially raises the risk of unintended execution and privacy-impacting behavior.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script writes detailed audit results and Markdown reports to disk containing project names, bidder pairings, potential collusion indicators, timing compliance issues, and scoring anomalies. In a government procurement context, these outputs may contain sensitive business, personal, or investigatory data, and the code provides no minimization, masking, access control, or explicit privacy/data-handling safeguards before persistence.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The script writes enterprise-derived matching results and a Markdown report to disk by default, and those outputs can contain sensitive business data such as company name, locations, certifications, historical project information, and inferred risk posture. In this government procurement context, persisting such profiling data without any consent prompt, minimization, redaction, or warning increases the chance of unintended disclosure through shared workstations, source directories, backups, or later redistribution.

Ssd 3

Medium

• Confidence: 86% confidence
• Finding: The skill directs collection and persistence of detailed enterprise profile data across conversations, including company identifiers and potentially sensitive business information. Persistent storage of such data expands the privacy and breach surface, especially when retention, encryption, access control, and deletion behavior are not clearly specified.

Ssd 3

Medium

• Confidence: 82% confidence
• Finding: The knowledge-base workflow saves analyses and reuses prior user data in future conversations, which can surface sensitive historical context unexpectedly. Without strong consent, scoping, and retention controls, this creates privacy risks, context leakage, and potential cross-task overexposure of past business information.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.