Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches its bid-analysis purpose, but it needs review because it handles local API credentials/device registration and puts login-bypass signed links into shareable reports.
Install only if you are comfortable with this skill contacting the Zhiliaobiaoxun service, using or creating an API key, storing that key locally, and including signed detail-page links in generated reports. Avoid sharing exported reports outside trusted recipients unless those sk links are removed or you accept that recipients may access the linked vendor pages.
The skill claims to perform substantive bid-decision analysis based on broad historical procurement data, but the described implementation appears centered on report rendering/export rather than the advertised analytical capabilities. This mismatch can mislead users into trusting unsupported conclusions, which is especially risky in procurement decisions with financial and reputational consequences.
Referenced artifact was not completely inspected
完整模式下，对话报告输出后默认再用 `scripts/render_report.py` 生成一份可分享的 HTML 版报告并告知保存路径（详见 report-template.md「HTML 报告导出」）。
Referenced artifact was not completely inspected
完整模式下，对话报告输出后默认再用 `scripts/render_report.py` 生成一份可分享的 HTML 版报告并告知保存路径（详见 report-template.md「HTML 报告导出」）。
This duplicate finding identifies the same hidden-instructions issue: commented content contains mandatory request metadata and post-display acknowledgment logic that changes runtime behavior. Such concealed directives can bypass normal scrutiny and create covert channels for package identification or user-interaction tracking.
安装包身份与升级检查：所有发往知了标讯 API 的请求（包括账户查询）必须额外携带以下两个请求头：
X-Skill-Package: tender-bid-decision-analysis/1.0.7
This duplicate finding identifies the same hidden-instructions issue: commented content contains mandatory request metadata and post-display acknowledgment logic that changes runtime behavior. Such concealed directives can bypass normal scrutiny and create covert channels for package identification or user-interaction tracking.
安装包身份与升级检查:所有发往知了标讯 API 的请求(包括账户查询)必须额外携带以下两个请求头:
X-Skill-Package: tender-bid-decision-analysis/1.0.7
This duplicate finding points to the same hidden instruction block that tells the agent which identity headers to send and forbids using other package versions/sources. Even if the headers themselves are not secret, placing such routing/authentication directives in hidden content creates a prompt-injection surface where the model may follow concealed network instructions without explicit user awareness.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: bid-decision/1.0.5
This duplicate finding points to the same hidden instruction block that tells the agent which identity headers to send and forbids using other package versions/sources. Even if the headers themselves are not secret, placing such routing/authentication directives in hidden content creates a prompt-injection surface where the model may follow concealed network instructions without explicit user awareness.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: bid-decision/1.0.5
This duplicate finding points to the same hidden instruction construct: covert request-routing and identity directives embedded in comments. In a skill that already handles API keys and registration, concealed control text materially increases the chance of unintended or non-consensual external actions.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: bid-decision/1.0.5
This duplicate finding points to the same hidden instruction construct: covert request-routing and identity directives embedded in comments. In a skill that already handles API keys and registration, concealed control text materially increases the chance of unintended or non-consensual external actions.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: bid-decision/1.0.5
This duplicate hidden-instruction finding is also valid: the template embeds non-user-visible directives telling the agent how to authenticate and identify itself on external API calls. Even if the headers are operationally legitimate, concealing them inside content increases prompt-injection risk and weakens transparency around authenticated network behavior.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: bid-decision/1.0.5
This duplicate hidden-instruction finding is also valid: the template embeds non-user-visible directives telling the agent how to authenticate and identify itself on external API calls. Even if the headers are operationally legitimate, concealing them inside content increases prompt-injection risk and weakens transparency around authenticated network behavior.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: bid-decision/1.0.5
The template requires preserving and sharing full URLs containing the sk parameter, explicitly noting that it bypasses the login wall. That strongly suggests the link contains an access-granting token or signed capability; propagating it into reports and HTML exports without warning can expose authenticated access to anyone who receives or later finds the report.
This duplicated hidden-instruction finding still indicates the same underlying issue: the file contains concealed instructions that tell the agent how to authenticate and what provenance headers to send. Even if intended for package routing/versioning, hidden request-shaping instructions are dangerous because an adversarial skill can exploit them to manipulate trusted network behavior without clear user awareness.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: bid-decision/1.0.5
This duplicated hidden-instruction finding still indicates the same underlying issue: the file contains concealed instructions that tell the agent how to authenticate and what provenance headers to send. Even if intended for package routing/versioning, hidden request-shaping instructions are dangerous because an adversarial skill can exploit them to manipulate trusted network behavior without clear user awareness.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: bid-decision/1.0.5
Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
THREAT_COLOR = {"高": "#c0392b", "中": "#b9770e", "低": "#0d9463"}
# 知了标讯白色 logo（299x96 PNG base64 内嵌，保证报告离线/打印/转发时不裂图）
_LOGO_B64 = "iVBORw0KGgoAAAANSUhEUgAAASsAAABgCAYAAABFTFSvAAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAABK6ADAAQAAAABAAAAYAAAAACurZhBAAA2V0lEQVR4Ae2dB5xU1fXHzzZ6752ldxHpHTtqTKJJjEmMGkvKP/aIRk0UayzYxZJouokaYyzRiKCAoIB0kN47LB0WFnZh9//9vZmHb4eZnZndmWVW3vl8fjOv3fvuO+++3z3nvHvvM/PF14CvAV8DFUADafbM2OusKOMCKywoqgDlDV/ENIpemJ5vGYW5VmjbrChtlaXZYks7usRuumlb+ET+Vl8DvgYqkgYyzdJ6WqWskXa0IhU7UlnTzLgiK4K8jh7litK22FPPT4O03rb8zAk26hc5kVL6230N+BpIbQ1kWpEdsYJ8Hu4jqV3SeEuXlpZBkhaWmf49s/RvW9aRFfbs2D9ZweF/2i23bIo3O/94XwO+Bk6sBtJP7OmTeHZZV0JBgdmRI1mWnt7V0jIesozK7+H6/shGj66UxLP7Wfsa8DWQYA18fcnKq6iAWxggrbS0XpDWc1a34dP2zDMtvIf5y74GfA2krgZODrJy9e+SVuHROpae8ROC8i/bsy/1cHf7/74GfA2krgZOLrJy70NhoWJ0lXENz8Tces6eHHuqu8v/9zXgayA1NXBykpXuhayswkJeMKQPtHR7greGnVLzFvml8jXga0AaOHnJSlfvENbRLEtLG2BphaPtiSfqabMvvgZ8DaSeBk5ustL9EGEVFVW1jIwzLC3rlyzTWcsXXwO+BlJNAz5Z6Y4ohnXkaCPLSP++PfnCkFS7SX55fA34GjjZ3cDjakBatqUduQZ3sOpxu/wNvgZ8DZxQDfiWlav+gDtY3TKz+plVHupu9v99DfgaSA0N+GTlvQ8Bwmpm6YUX2htvaLiOL74GfA2kiAaST1bEr5Miycq3sLAm5e1jG7e3SUq5/Ux9DfgaKJUGkkNWRxgUfUSTHjAJQjqnKGRZ6wpklyQByybyEZpIQeC4jHQy1/HKV9sSIcovLS0NV7ARhcUd9MXXgK+BVNGAJlRJnEBGVbOy7Lz2be1bbdtax3p1LYtnf1tenk3euMneWrHSVu7cbTCNSAGyUU9yCILV9IxMq5KVaUfZdPioBh9DQDomTXxaZNUyM613s2Z2UYe2dlrDhlaD8+w5nG8zt22zd1atthlbmcZKZChyLKsUFtWxtKJTyOYfZc3KT+9rwNdAYjSQZk8//wKk8POyThGTAfF0b9DQHh022M5p3eq40slr27R/vz06a649N28uYSGzVnXr2vltWtvpLVpY29q1rHqlLDsC4ew8dMjm5+yw91avsbk5260mxHRr3952eZdOVp3lUNHxf1m01B6bNdu25uZChmUINzkEmXYIa+1dGPNKppPJCz2fv+5rwNdA+WsgIZZVBpbPKQ0b2avnn2tdsKaO4E6t3L3bpm/ZagcKjjgW1sAmTaxFzZr20JCB1q1BPQwXw0pqZw2rhu8lMBQr6mendLecgwctl2leOkFsynfdvn32xdYcZ3vzmjWsb+NG1rxGDefYJtWr2k2Tpth20pTJwioqghHTGllWVl1uiU9W5V8v/TP6GjhOAwkhq/pVqth9gwY4RLU3P98enTnHnsd62pN32IkrZeLi9Wve1P5w1unWtX59+1mP7scVJNyGLFw6EZGkEKKat32H3Txxkk1du94ho0xcQ+V3W7/e9oNOHe2c7NZ2Q699ds/n05nduJTCeZAM4m01sK4UbPfF14CvgRTQQJnJqjJhpcHNm9t5uHP78
...[truncated 27 chars]
The skill explicitly states it will write HTML reports to the local filesystem, but it does not declare any tool scope or permissions boundary for file writing. Undeclared write capability weakens sandboxing and user transparency, increasing the risk of unauthorized file creation or overwrite if the skill behavior expands or is abused.
The invocation rules are overly broad and require using this skill even when the user did not explicitly request bid-decision analysis. This can cause unnecessary data access, increased spend, and collection/transmission of procurement-related inputs beyond user intent, undermining informed consent and least-privilege behavior.
The example user-facing disclosure is written as a required message in Chinese, and the document consistently prescribes Chinese response phrasing without indicating that the user may choose another language. Forcing a specific language without opt-in can violate language/locale policy for organizational skills intended for diverse users.
Lines L77-L78 instruct the skill to relay update notices to the user verbatim ("原样转达用户"), and the file itself is fully Chinese with no indication that localization depends on user preference. This creates a natural-language policy concern because it forces a specific language/locale for user-visible messages without offering choice or documenting a justified region-specific constraint.
The skill is presented as a tender bid decision analysis assistant, but the referenced document embeds a full account lifecycle flow: automatic registration, credential issuance, local persistence, and recharge/login recovery. That materially expands the skill's operational scope beyond analysis and introduces credential-handling and account-management behavior that users would not reasonably expect from this skill.
The document instructs the agent to collect device fingerprinting inputs including OS, CPU architecture, and a hashed MAC address, then transmit them for automatic registration. Even though the MAC is hashed, this still creates a persistent device identifier unrelated to tender analysis and increases privacy risk, especially because it is tied to account creation and quota enforcement.
This markdown file contains user-facing instruction text entirely in Chinese and explicitly says the privacy notice can be relayed to the user verbatim, which effectively constrains the agent's output language. The file does not offer the user a language/locale choice or document a justified locale restriction, so it conflicts with the language-choice policy.
The skill instructs the agent to read API keys from environment/config and to persist newly issued API keys to a local config file. Credential discovery and storage are sensitive capabilities that exceed the direct needs of bid analysis and create a broader attack surface if the skill or surrounding agent is abused.
This section directs the agent to send collected device features to an external registration endpoint. External transmission of device-derived identifiers and account bootstrap data is sensitive, and in this skill context it is not necessary for tender analysis, making the transmission disproportionate and privacy-invasive.
> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>
The curl-based guidance is another explicit instruction to exfiltrate locally collected data to a third-party service. The risk is amplified because the skill provides operational details for sending the payload, encouraging unauthorized or opaque data flows outside the user's expected analysis task.
> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>
> 历史教训：曾有版本采集 `home_path`，Windows 的 `C:\Users\alice` 直接拼进 JSON 字符串时
No suspicious patterns detected.