biaoshu-bailian

• Outcome: Review
• Latest audit: Oct 13, 2026 · 2:23 AM UTC
• Version: 2.0.6

Overview

The skill appears to be a real cloud bid-document workflow, but it under-discloses sensitive account setup, device/phone data collection, credential handling, paid usage, and remote document transfer.

Review carefully before installing. Only use this skill if you are comfortable sending bid/procurement files to the vendor cloud, storing an API key locally, potentially pasting credentials into chat, and allowing trial/account flows that may collect device and phone/SMS information. Avoid confidential or regulated tender materials unless the vendor's retention, deletion, billing, and data-use terms are acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (59)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description centers on bid-document processing, but the document also instructs the assistant to perform additional sensitive actions: device fingerprint collection, trial-account provisioning, phone/SMS registration flows, local credential persistence, experience upload, and issue reporting. These extra capabilities materially expand data collection and account-management behavior beyond the core stated purpose, increasing privacy and consent risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill description centers on bid-document processing, but the document also instructs the assistant to perform additional sensitive actions: device fingerprint collection, trial-account provisioning, phone/SMS registration flows, local credential persistence, experience upload, and issue reporting. These extra capabilities materially expand data collection and account-management behavior beyond the core stated purpose, increasing privacy and consent risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description centers on bid-document processing, but the document also instructs the assistant to perform additional sensitive actions: device fingerprint collection, trial-account provisioning, phone/SMS registration flows, local credential persistence, experience upload, and issue reporting. These extra capabilities materially expand data collection and account-management behavior beyond the core stated purpose, increasing privacy and consent risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description centers on bid-document processing, but the document also instructs the assistant to perform additional sensitive actions: device fingerprint collection, trial-account provisioning, phone/SMS registration flows, local credential persistence, experience upload, and issue reporting. These extra capabilities materially expand data collection and account-management behavior beyond the core stated purpose, increasing privacy and consent risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill states that installation will automatically open a trial account, collect device characteristics, and save an API key locally, but it does not require a clear upfront informed-consent flow. Automatically enrolling users and persisting credentials/device identifiers without explicit approval creates serious privacy, account-control, and trust risks.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

**升级 skill 必须保留配置**：如果当前已安装目录存在 `config.json`，升级时不得删除、覆盖或替换该文件；只能更新 `SKILL.md`、`scripts/`、`references/` 等 skill 内容文件。本地生成目录 `biaoshu-writer-tech-files/` 也必须保留。

Lp1

High

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The client reads sensitive configuration from environment variables such as ZCM_APP_KEY and ZCM_BASE, but the skill description only presents document-processing behavior. Undeclared access to environment data expands the trust boundary and can expose secrets or enable unexpected network routing if a host platform grants broader env access than users expect.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The guidance explicitly tells users to paste a live API key into the conversation so the assistant can save it. Conversation channels may be logged, retained, visible to operators, or exposed to other integrations, so asking users to transmit bearer credentials through chat materially increases secret-compromise risk.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

When credentials are missing, the interactive flow prompts the user to paste the API key directly. This treats a bearer secret as ordinary conversational content, making compromise via logs, analytics, prompt history, or support review much more likely.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trial flow gathers hostname, platform, architecture, username, home path, and a hashed MAC-derived identifier to build a device fingerprint. This is excessive for a document-analysis skill and can uniquely identify users or machines across sessions, creating significant privacy and tracking risk if stored or correlated server-side.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The insufficient-balance flow asks users to paste a replacement API key into the interaction. This repeats insecure secret-handling behavior in a recovery path, increasing the likelihood that valid production credentials are exposed during troubleshooting.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The file performs outbound network access via urllib.request.urlopen in download_to_local(), but the static finding indicates this capability is not covered by declared permissions. In a skill that processes user-supplied tender/bid documents and URLs, undocumented network access increases SSRF-style risk, may fetch internal resources or unexpected remote content, and expands the trust boundary without explicit user/admin awareness.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The activation text is extremely broad and can trigger on ordinary bidding-related discussion, causing the assistant to invoke a cloud-processing workflow on sensitive procurement documents more often than users may expect. In this context, overbroad triggering increases the chance of unintended data transfer, credential prompts, or processing of confidential commercial material.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation gives conflicting instructions about where API credentials should be stored: metadata says ~/.zcm/config.json, while the body insists credentials must be written in the installed skill directory and not to the global path. Contradictory credential-storage rules cause accidental leakage, broken isolation, unintended credential reuse across skills, and operational mistakes during upgrades.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest claims that device information, phone numbers, and verification codes are not collected, yet the body says installation will automatically collect device fingerprints to provision a trial account and directs users through phone/SMS registration. This is a direct transparency and privacy contradiction that can mislead users and operators about what personal/sensitive data is processed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs users to paste API keys into chat and then save them to a local config file, but it does not present a prominent security warning about credential-handling risks. Asking for secrets in conversation and storing them locally without strong user education or safer alternatives increases exposure to accidental disclosure, logging, or insecure persistence.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file's natural-language instructions and user-facing guidance are entirely in Chinese, and there is no indication that this language restriction is optional or tied to a documented region-specific requirement. Per the policy category, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The workflow explicitly instructs the skill to submit generation jobs without warning about insufficient balance, even though generation can consume paid usage and may run until funds are exhausted. In this context, that creates a billing-consent and resource-consumption risk: users may trigger long-running paid operations without clear pre-authorization or timely guardrails, and may receive only a partial output after chargeable work has already occurred.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation explicitly states that uploaded bid files and generated results are retained on the vendor's servers under the account identity, but it does not require any user-facing disclosure, consent, or handling guidance. Because these documents can contain commercially sensitive, personal, or regulated procurement data, silent server-side retention increases privacy, confidentiality, and compliance risk if users are unaware of persistence and retention duration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document title and the entire operating manual prescribe Chinese-language interaction as the default behavior, and later sections explicitly require relaying script output directly to users in Chinese. There is no indication that the user may choose another language or locale, which can violate language/locale policy when applied to users who did not opt in.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/usage.md (reported line 70)May include surrounding context.

json

   {"app_key":"bk_live_xxxxx","base":"","output_dir":""}

建好后 chmod 600 config.json（含真实 Key）。通常不用手写——方式 2~5 任一命令都会自动生成到当前 skill 根目录。 2. 用户把 Key 发你后，先定位当前安装的 biaoshu-writer-tech/SKILL.md 所在目录，再由你代跑 login --app-key bk_live_xxx 保存（自动建/更新同级 config.json，权限 600）——别把这条命令丢给用户自己敲。 3. 临时用环境变量：export ZCM_APP_KEY=bk_live_xxx（首次会自动落盘到当前 skill 根目录的 config.json，不是全局目录）。 4. 没 Key 想直接注册：向用户要手机号，由你代跑 register --phone（skill 内手机号+短信验证码换取 Api Key，自动保存）——见本节末尾「绑定手机号 / 可用字数不足」流程，别让用户自己敲命令。

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains numerous user-facing strings and status labels in Chinese, such as risk labels and semantic state text, and later emits fixed Chinese output lines. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code hard-codes Chinese report titles and labels, causing generated reports to be presented in a specific language regardless of user preference. The file does not offer any language selection or indicate that the skill is intentionally limited to a Chinese-only regional context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The compliance renderer initializes a Chinese-only report and continues with Chinese section headings and labels throughout the function. This creates a language policy concern because users are not given a choice of locale and the constraint is not justified in this file.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/zcm_lib/reporting.py:59