tender-scraper-xiaobai

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 4:16 AM UTC
• Version: 1.0.0

Overview

This skill appears to be a straightforward tender-announcement scraper with disclosed network access and no evidence of hidden persistence, credential access, or destructive behavior.

Before installing, run it in a virtual environment or container, pin reviewed dependency versions, and remove beautifulsoup4 unless it is actually needed. Expect it to contact ygcg.nbcqjy.org to retrieve tender公告 data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned and Unnecessary Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, lines 1-2
Vulnerability Type: Supply-chain exposure through unpinned dependencies
Risk Level: Medium

Vulnerable Code:

text

requests
beautifulsoup4

Technical Analysis

The project declares requests and beautifulsoup4 without exact version constraints or package integrity hashes. Consequently, each installation may resolve to different package versions from the configured Python package index. This prevents reproducible builds and allows newly published, compromised, or unexpectedly incompatible releases to be installed without an explicit source-code change.

The current implementation imports and uses requests, but no reviewed project file imports beautifulsoup4. Retaining this unused package unnecessarily increases the dependency tree and supply-chain attack surface.

This finding does not establish that either named package is currently malicious. The weakness is that the dependency policy implicitly trusts whichever versions and transitive dependencies are available when installation occurs.

Attack Path

1. An attacker compromises a dependency release, a transitive dependency, the configured package registry, or the package-resolution path used by the deployment environment.
2. A user or automated deployment process installs the project with pip install -r requirements.txt.
3. Because no exact versions or hashes are specified, the installer resolves and downloads the affected release.
4. Malicious package installation logic may execute during installation, or malicious module logic may execute when the crawler imports the dependency.
5. The payload runs with the privileges and environment access of the account performing installation or executing the crawler.

Exploitation depends on compromise or manipulation of the external dependency supply chain; no direct package compromise was identified in the audited files.

...[truncated 661 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove beautifulsoup4 unless a documented and reviewed code path requires it.
2. Pin requests and every required transitive dependency to reviewed versions through a generated lock file.
3. Require package hashes during installation, for example by maintaining a hash-locked requirements file and installing with pip install --require-hashes.
4. Generate locks from a trusted package index in a controlled build environment rather than resolving dependencies during production deployment.
5. Use automated dependency vulnerability scanning and regularly regenerate reviewed pins to receive security updates.
6. Install and run the crawler in an isolated virtual environment or container under a non-privileged account with minimal filesystem and network access.
7. Cache or mirror approved artifacts in a controlled internal repository and verify artifact provenance where supported.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crawl.py (reported line 46)May include surrounding context.

python

"InfoTypeId": None
            }

            response = requests.post(API_URL, headers=HEADERS, json=payload, timeout=30)
            result = response.json()

            if result.get("header", {}).get("resultType") != 1:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The only natural-language content in this file is the comment "招投标配置", which is written solely in Chinese. Under the stated policy, forcing or assuming a specific language without offering user choice can be a locale/language policy violation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency 'requests' is included without a pinned version, which makes builds non-reproducible and can cause installation of different releases over time, including vulnerable ones. In this file, that risk is more meaningful because static analysis also indicates known advisories exist for some 'requests' versions, and the manifest does not constrain which version will be installed.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests
beautifulsoup4

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The manifest references 'requests' without a version, while multiple advisories are known to affect some releases of that package. Because the file does not specify a version, it is impossible to verify whether installation will select a safe release, creating a real dependency-risk exposure.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The dependency 'beautifulsoup4' is also unpinned, so installs may resolve to different versions over time and reduce build integrity and reproducibility. Even without a cited advisory here, leaving it unconstrained increases supply-chain and stability risk compared with an explicitly reviewed version.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

requests
beautifulsoup4

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file-level docstring presents the skill name and usage entirely in Chinese, which can amount to a language/locale constraint in the natural-language interface of the skill. There is no indication that users may choose another language or that the Chinese-only presentation is required for a region-specific audience.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.