Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/generate_bid.py --info info.json --output ./output
Security audit
Tender Generator Pro
Security checks for vulnerabilities and agentic risk
Overview
This skill appears to be a disclosed Chinese tender-document generator that reads user-provided bid data and writes local Word/zip outputs without hidden network, persistence, or credential behavior.
Install only if you are comfortable processing tender materials locally with this skill. Review outputs before submission, protect info.json and generated archives because they may contain bank and pricing details, and expect possible setup or reliability fixes for python-docx and fallback template generation.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/generate_bid.py --info info.json --output ./output
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/generate_bid.py --info info.json --output ./output
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/generate_bid.py --info info.json --output ./output
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/generate_bid.py --info info.json --output ./output
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/generate_bid.py --info info.json --output ./output
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/generate_bid.py --info info.json --output ./output
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The entire skill documentation is written in Chinese and presents the workflow, examples, and cautions only in that language. There is no indication that the skill is region-specific or that users may choose another language, which can violate language/locale policy expectations requiring opt-in or justification.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises and instructs shell execution and file read/write behavior via python3 scripts, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates a capability/authorization mismatch: a host may grant broader access than users expect, enabling document extraction, file generation, archive creation, and processing of uploaded templates without clear confinement.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This skill is designed to collect and process highly sensitive business and personal information, including credit codes, bank account details, representatives, and pricing, but it lacks an explicit warning and consent model for such data. Users may provide regulated or confidential procurement information without understanding retention, exposure, or logging risks.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrase "帮我生成一套标书" is close to ordinary user speech and can overlap with natural conversation, increasing the chance of accidental invocation. In a skill that reads documents, writes files, and may run scripts, broad triggering can cause unintended handling of sensitive bid, company, and financial data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description is written entirely in Chinese and presents the skill as a Chinese-language tender generator without indicating any user choice of language or locale. This can violate language/locale policy when the skill implicitly constrains interaction to a specific language without opt-in or documented regional justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file’s natural-language description and generated document content are entirely Chinese, and the code hard-codes Chinese fonts such as 宋体 and 黑体. Because there is no user opt-in, alternative locale handling, or documentation that this skill is limited to Chinese tender workflows, this appears to impose a specific language/locale by default.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script’s user-facing natural language, including the module description and later CLI prompts/messages, assumes Chinese as the required interaction language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The fallback document creation loop calls every creator as creator(output_dir / f"{doc_name}.docx", info, args.tma), but most creator functions accept only two parameters. When any missing document other than the technical plan is generated, this will raise a TypeError and can halt or partially break bid package generation, resulting in incomplete or inconsistent output. In the context of tender document automation, that reliability failure can directly affect submission readiness and business operations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill description and usage instructions are entirely in Chinese and direct the user to interact using Chinese phrases, without indicating any language choice or opt-in. This can constitute a language/locale policy issue if users are expected to use the skill in a specific language by default.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This JSON file contains all user-facing content and field values in Chinese, with no indication that the language choice is optional or limited to a region-specific workflow. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.