Security audit

Gov Procurement Analyst

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for government procurement analysis, but needs Review because it stores sensitive enterprise/procurement data and overstates local-only privacy despite remote-style fallbacks and integrations.

Install only if you are comfortable with local long-term storage of company profile, bid, competitor, and collaboration data. Before using certificate OCR, multimodal recognition, scheduled monitoring, webhooks, or the updater, confirm exactly what data leaves the machine, where databases are stored, and how to delete or disable retained records.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (20)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill makes a strong privacy claim that enterprise data stays local and is never uploaded, yet elsewhere documents a fallback to 'multimodal recognition' for OCR. That creates a direct contradiction that can mislead users into providing sensitive certificates, business licenses, and identifiers under false assumptions about data locality. Because the skill handles corporate credentials and registration data, unexpected external transmission materially increases confidentiality and compliance risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README advertises very broad natural-language triggers such as '这个标能不能投' and '帮我看看这个标', and frames automatic activation as a core UX feature. In a conversational assistant, such generic phrases can cause unintended invocation on ordinary discussion, which is risky because this skill performs profiling, compliance analysis, and procurement decision support with potentially sensitive business consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill prominently promotes competitor deep profiling, supplier background checks, personnel tracking, and strategic analysis, but the description does not provide a clear upfront warning about the breadth of profiling and monitoring involved. Users may unknowingly invoke workflows that aggregate sensitive business intelligence, creating privacy, compliance, and misuse risks in a government procurement context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger table contains multiple ambiguous phrases like '政府采购', '体检', '评分预测', and '竞争对手分析' that overlap with normal user queries. Because the skill bundles many powerful modules behind these phrases, accidental activation could launch data collection, profiling, or strategic analysis without the user's informed intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill solicits and persists sensitive enterprise data including company name, location, qualifications, project history, and unified social credit code, but does not prominently emphasize data minimization, retention, access controls, or deletion. Even when stored locally, such a dataset is valuable for profiling and could be exposed through backups, shared accounts, or later features that reuse the profile without the user's full awareness.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Overly broad natural-language trigger phrases increase the chance that unrelated conversation will invoke powerful workflows such as web collection, document analysis, or storage of enterprise data. In a skill with many side effects and routing paths, accidental activation can lead to unintentional data processing, unnecessary network access, or persistence of sensitive information without clear user intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Generic English triggers like 'government procurement', 'bidding', and 'tender' are so broad that they can match incidental discussion and route users into active modules. Given this skill's large action surface, that raises the risk of unintended execution, data fetches, and analysis on content that was not meant as a command.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The '边界与限制' section says '此 Skill 不处理' government procurement complaint handling procedures, only providing guidance and templates. But elsewhere the documented functionality includes a full '质疑投诉处理指引' module with workflow, deadline calculation, complaint templates, evidence lists, and supervising department contact details (L0685-L0717, L1790-L1791, L1806-L1814), so the boundary statement contradicts the actual described behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The example headers hard-code Accept-Language: zh-CN,zh;q=0.9,en;q=0.8, which forces a locale preference without any user opt-in or runtime adaptation. While not directly enabling code execution or privilege abuse, it can misrepresent the user's language preferences, affect returned content, and create privacy/compliance issues if requests are made on a user's behalf.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file contains user-facing operational guidance exclusively in Chinese, and it does not indicate that users may choose another language or that the skill is restricted to a Chinese-speaking or China-specific audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring, CLI description, and generated report text indicate the skill forces a specific language/locale for all users. Under the stated policy, language constraints are a violation unless the skill offers user choice or clearly documents a justified regional scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The module docstring presents the skill's purpose and usage context exclusively in Chinese, which can amount to a language-policy issue when no alternative language or opt-in is provided. There is no indication that the skill is intentionally restricted to a Chinese-speaking or region-specific audience.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The HTTP header forces Accept-Language to prefer zh-CN, and the script’s user-facing interface and output strings are entirely Chinese. Under the stated policy, forcing a specific language/locale without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code file contains natural-language strings that force a specific language/locale for documentation and CLI interaction. Under the policy, a fixed language is a violation unless the skill offers user opt-in or clearly documents a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This is a natural-language policy issue because the skill presents its usage instructions in a single language and does not indicate any language selection or alternative locale support. Users who do not read Chinese may be unable to understand how to run the tool safely or interpret its outputs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The top-level natural-language description presents the skill entirely in Chinese and labels its functionality for a Chinese government bidding workflow, with no indication that language is configurable or user-selected. This can violate a language/locale policy when a skill implicitly mandates a specific language without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: All user-facing descriptions, trigger phrases, examples, and instructions are presented only in Chinese, and the README does not state that the skill is intentionally limited to a Chinese-language or China-specific deployment context. Under the policy, forcing a specific language without opt-in can be a natural-language policy issue unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: 文档在快速体验中使用“发送以下任意指令”并列出多种口语化表达，例如“查一下XX公司”“政府采购最新政策”“编制采购需求”等，但未说明这些只是示例、是否必须包含项目/企业/地区等关键信息。这会让用户难以判断什么输入会触发、什么不会触发。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: 该文档从标题到全文说明均固定为中文表述，且没有说明是否支持其他语言或允许用户选择语言。根据规则，强制特定语言而未提供用户选择，属于自然语言层面的语言/地区政策风险。
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script automatically creates a persistent SQLite database under the user's home directory and writes project, assignee, deadline, and chapter history data without any notice, consent, or retention controls. In a collaboration tool handling procurement/bid information, silent persistence can expose sensitive business data to other local processes or future users of the same account and may violate user expectations or policy requirements.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.