T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/project_scoring.py:15- Finding
Unvalidated scoring inputs allow bid-ranking manipulation
- Content
View full analysis
- Remediation
View remediation
Security audit
胡田 OPC导师 获客分包平台
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a legitimate business workflow skill, but it should be reviewed carefully because it handles bidding, reputation, contracts, customer details, and payment data without enough explicit safeguards.
Install only if you intend to use it for a Chinese-language OPC subcontracting workflow. Before giving it real platform access, require manual approval for bid awards, credit changes, public postings, account freezes, document writes, and settlement/payment actions; restrict outputs to a dedicated folder; validate scoring inputs; and add privacy rules for contacts, customer data, case studies, bank/account fields, invoices, tax records, and reputation history.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (40)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is presented as a platform operations tool for task dispatch and capability matching, but it also performs bid scoring, ranking, and winner recommendation. Hidden or under-disclosed decision-making logic can materially affect project allocation and commercial outcomes, especially when users believe the skill is only assisting with routing or matching.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a platform operations tool for task dispatch and capability matching, but it also performs bid scoring, ranking, and winner recommendation. Hidden or under-disclosed decision-making logic can materially affect project allocation and commercial outcomes, especially when users believe the skill is only assisting with routing or matching.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 1 | `SKILL.md` | Skill主文件 | ⭐⭐⭐ 必读 |
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest describes an operations tool for customer-acquisition task distribution and capability matching within the OPC ecosystem, but this file implements a tender/bid evaluation calculator that scores bidders on credit, performance, proposal quality, price, and delivery time, then ranks them. That is a materially different business function from customer-acquisition dispatch or matching.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file uses Chinese throughout the title, description, usage instructions, and ecosystem overview, but does not indicate that the skill is region-specific or provide any user opt-in for language/locale. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill describes capabilities that generate and save local contract, evaluation, and settlement documents, but it does not declare any explicit tool scope such as allowed-tools or permissions. In an agent environment, undocumented file-write capability increases the chance of unintended file creation or overwrite and prevents users from understanding what filesystem access the skill requires.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill explicitly handles client information, project archives, credit ledgers, governance data, and downstream data exchange, yet it provides no visible privacy warning, data classification guidance, or handling restrictions. In a business-collaboration context, this can lead to inadvertent exposure of sensitive customer, financial, and reputation data across skills or local files.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow explicitly collects and shares customer and participant information such as names, contact details, project requirements, skill profiles, credit ratings, and evaluation records, but it does not define any privacy notice, consent basis, access controls, retention limits, or masking rules. In a multi-party bidding and subcontracting platform, this omission can lead to unnecessary disclosure of personal and business-sensitive data across mentors, reviewers, bidders, and platform operators.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The design processes highly sensitive financial and tax information, including shared accounts, payout destinations, contribution-based revenue allocation, and tax withholding, but provides no warning or control framework for handling that data. Because this workflow involves payments and multi-party confirmations, missing safeguards can expose bank/account information, financial records, and tax data to unauthorized parties and increase fraud or compliance risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The entire skill file is written only in Chinese and does not state that the language requirement is optional, user-selected, or justified by a region-specific compliance need. Under the policy rule for natural-language violations, forcing a specific language without opt-in can be a locale-policy issue.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The publication template explicitly collects personal contact details from the publisher but does not specify whether that information is public, who can access it, or whether safer platform-mediated contact should be used instead. In a project listing workflow, this can lead to unnecessary exposure of personal data, spam, social engineering, and privacy compliance issues if users assume the form is internal but the data is later displayed or broadly shared.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The simplified D-level publication form requests contact information in an even more condensed workflow, which increases the chance that users provide personal phone numbers or messaging IDs without understanding the publication scope. Because D-level projects are auto-approved, the lack of privacy warning or review makes accidental public disclosure more likely and easier to exploit for harvesting or impersonation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The public listing rules require increasingly detailed project information and, for higher tiers, customer profile and strategic value disclosures, but provide no warning or constraints around sensitive data exposure. In the context of a customer acquisition and outsourcing platform, this materially raises the risk of leaking business-sensitive information, customer identities, internal strategy, or personal data to a broad audience or competitors.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document explicitly states that comprehensive scores and credit grades are visible to the whole community, while member records include identifying information and historical evaluations. Publishing reputation-related data without clear minimization, consent, retention limits, or appeal/privacy safeguards can expose users to privacy harm, profiling, and lasting reputational damage.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The handbook explicitly says to collect customer evaluations at project close and use them for promotion, but it does not mention obtaining informed consent, defining scope of use, or handling personally identifiable or commercially sensitive information. In a customer-acquisition platform context, testimonials can easily include names, company details, project outcomes, or screenshots, creating privacy, confidentiality, and reputational risk if reused without authorization.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document directs operators to organize project cases into a case library and publicity materials without warning about exposure of customer identities, deliverables, business metrics, or confidential project details. Because this skill is for an operations platform handling real client projects during early-stage growth, normalizing case collection for publicity increases the chance of oversharing sensitive customer or project data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
SQP-3 applies to all file types and includes language/locale policy violations. The module docstring presents the skill description exclusively in Chinese, which can force a specific language on users without any opt-in or explanation that the tool is region-specific.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
In generate_bid_evaluation, the function builds the document with an f-string directly in the return path, but later returns content at L190 even though no content variable is defined. This contradicts the function's docstring '生成评标打分表' because the implementation will raise an error rather than generate the document.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
generate_subcontract is documented at L193 as generating a subcontract agreement and constructs the agreement text via an f-string at L194-L221. But L222 returns content, which is never defined, so the code does not perform the documented generation successfully.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The function docstring at L225 says it generates an SPV cooperation agreement, and the function assembles the text in a returned string expression at L238-L265. However, L266 returns content, which is undefined, so the implementation does not match the documented intent.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The docstring at L269 describes the function as generating an NDA, and the function constructs the NDA text in an f-string at L270-L294. But L295 returns content without defining it, so the code contradicts the documented behavior by failing rather than generating the agreement.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The function says it generates a quality commitment letter and builds the text at L299-L328, but L329 returns content that is never defined. This means the implementation does not actually produce the documented output.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The function docstring at L332 states it generates a milestone acceptance form, and it assembles the form text at L358-L374. However, L375 returns content, which is undefined, so the function contradicts its stated purpose.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The function is documented at L378 as generating a distribution confirmation document and builds document text at L384-L411. But L412 returns content without defining it, so the implementation fails instead of generating the described output.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The docstring at L415 says the function generates a project closing report, and the report body is constructed at L416-L448. Yet L449 returns content, which is not defined, so the implementation does not fulfill the documented behavior.
- Content
Static analysis
No suspicious patterns detected.