定制化招标信息采集

• Outcome: Review
• Latest audit: Aug 9, 2026 · 2:14 PM UTC
• Version: 0.1.0

Overview

The skill is mostly a coherent bid-monitoring tool, but it needs Review because it can auto-run local JavaScript adapters and its local-only privacy claims do not clearly cover webhook notifications.

Install only if you are comfortable with a networked browser automation tool that stores bid intelligence locally and can send reports to configured webhooks. Review any custom adapter JavaScript before placing it under ~/.bidding-hunter/platforms or adding it to custom_paths, and treat exploration of new URLs as a developer action limited to trusted public procurement sites.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises and instructs use of CLI tooling that accesses environment variables and the network, but no explicit permission model or disclosure is declared in the skill metadata. This can mislead operators about the actual execution capabilities and weakens least-privilege review, especially because the workflow includes scanning external sites and reading webhook secrets from the environment.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The design states the tool is not for arbitrary websites, yet the extension flow explicitly allows exploration of any user-supplied URL. That creates a capability gap where the tool can be repurposed as a general browser automation/scanning utility, increasing exposure to unsafe targets, SSRF-like access patterns, and scope creep beyond procurement monitoring.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Auto-discovering and executing user-provided JavaScript plugins from user-writable paths gives arbitrary code execution inside the skill runtime. A malicious or compromised plugin can read local files, exfiltrate data, make network requests, or alter scan and notification behavior far beyond the stated bid-discovery function.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Exploration mode navigates arbitrary user-supplied URLs, which broadens the skill from a domain-specific procurement scanner into a generic web navigation agent. This can be abused to access unexpected content, follow malicious pages, or probe internal resources if network boundaries are not enforced.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The documentation states that 'all data stays local' and there are 'no telemetry or cloud uploads,' yet later provides webhook integrations that can transmit scan results to Feishu or Slack. This is a materially misleading privacy/security claim that may cause users to enable notifications without realizing procurement-related data is leaving the local system.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The CLI exposes an AI/browser-assisted exploration workflow plus adapter-generation features that go beyond passive bid discovery and reporting. In this context, the dangerous part is not the printed guidance itself, but that it normalizes and scaffolds agent-driven browsing and creation of executable adapter code, which can expand the trust boundary to arbitrary sites and user-generated plugins.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The code references `ctx.politeDelay` inside `scan`, but only `context` is defined. This causes a runtime `ReferenceError` on the first search path, breaking scraping and creating an easy denial-of-service condition where the adapter silently fails to collect results. In this skill context, reliability matters because missed procurement notices can cause users to miss deadlines and opportunities.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The code references `ctx.politeDelay` inside `scanSource`, but `ctx` is never defined in scope; the function only receives `context`. This causes a runtime `ReferenceError` during normal execution, breaking scanning for this adapter and creating a denial-of-service condition for this platform's collection workflow.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: A second use of undefined `ctx` occurs before/after the search action, again causing a runtime exception when this path executes. Because this adapter automates UI searches across procurement sources, the bug can reliably halt data collection and cause missed results or deadlines.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The pagination logic also uses undefined `ctx`, so multi-page browsing fails when attempting to move beyond the first page. In this skill's context, that is operationally significant because it can silently reduce procurement coverage and cause users to miss relevant bid notices.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The notification system sends matched bid data, titles, regions, dates, and URLs to external webhook destinations without describing consent prompts, data classification, or outbound sharing controls. In enterprise or regulated contexts, this can lead to unintended disclosure of monitoring targets or internal workflow metadata to third-party services.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The webhook configuration example encourages external notification setup but does not warn that matched bids, deadlines, keywords, or related metadata may be sent to third-party endpoints. In a government procurement-monitoring context, this can expose sensitive business intelligence or operational data outside the local environment.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The registry automatically requires JavaScript files from a user-writable directory, which executes module top-level code immediately on load. In a plugin-based tool this may be intentional functionality, but it still creates a real code-execution trust boundary: any attacker who can place or influence files in ~/.bidding-hunter/platforms can achieve arbitrary code execution in the context of the running process.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code loads and executes arbitrary .js files from config.platforms.custom_paths via require(path.resolve(p)), with no trust verification, confirmation, or isolation. If an attacker can modify configuration or influence these paths, they can cause arbitrary code execution when the registry enumerates adapters.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

A config-driven, reusable bid discovery engine that automates the tedious process of monitoring Chinese government procurement platforms.

**Compatible with any AI assistant that can execute CLI tools:** OpenClaw, Claude Code, Codex CLI, Cursor Agent, and similar platforms. The skill is platform-agnostic — all operations are exposed through the `bidding-hunter` CLI and standard shell commands.

## 🚨 MANDATORY TOOL DISCIPLINE — READ FIRST

• Confidence: 85% confidence
• Finding: The skill is described as compatible with any assistant that can execute CLI tools and imposes strong instructions to use its CLI and shell commands, but does not define any scoped tool or command allowlist in metadata. In agent environments, this effectively broadens execution authority and can normalize unrestricted command use, increasing the chance of unintended file, network, or process access.

Known Vulnerable Dependency: playwright==1.40.0 — 1 advisory(ies): CVE-2025-59288 (Playwright downloads and installs browsers without verifying the authenticity of)

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: This manifest includes Playwright 1.40.0, which is flagged with an authenticity-verification advisory for downloaded browser binaries. In a skill that automates browsing across external procurement sites, that is more dangerous because the package routinely acquires and executes browser components, increasing supply-chain compromise risk on developer or deployment systems.

Known Vulnerable Dependency: yaml==2.3.0 — 1 advisory(ies): CVE-2026-33532 (yaml is vulnerable to Stack Overflow via deeply nested YAML collections)

Low

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: yaml 2.3.0 is reported vulnerable to stack overflow from deeply nested YAML structures. Because this skill advertises configurable targets and likely consumes configuration files, malicious or malformed YAML could crash the process and cause denial of service if untrusted configuration is accepted.

Known Vulnerable Dependency: ajv==8.12.0 — 1 advisory(ies): CVE-2025-69873 (ajv has ReDoS when using `$data` option)

Low

• Category: Supply Chain
• Confidence: 77% confidence
• Finding: ajv 8.12.0 is flagged for ReDoS when the $data option is used. The manifest alone does not prove that $data is enabled, so exploitability is context-dependent; however, this skill appears to validate configurable user input, making the dependency relevant enough to treat as a likely vulnerability with limited impact.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.