Gx Bidding Monitor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:56 AM UTC
• Version: 1.0.0

Overview

The skill mostly does the advertised bidding-monitoring work, but it tells users to store procurement-site credentials in plaintext and can print account identifiers, so it needs careful review before installation.

Install only if you are comfortable with a browser-based tool visiting many procurement sites and writing daily results locally. Do not place real passwords in references/gx_websites.json unless you can protect that file, keep it out of source control and shared archives, and accept the risk; prefer a separate secret manager or runtime-only credentials. Avoid using --auth-only in logged or shared terminals if account identifiers are sensitive.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/config-guide.md:10

Finding

Plaintext credential storage is explicitly encouraged

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/gx_bidding_monitor.py:264

Finding

Configured account identifiers are exposed in terminal and automation logs

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:19

Finding

Unnecessary third-party packages are installed without version or integrity constraints

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The documented purpose is narrow, but the behavior described by analysis includes handling account-related information, generating outbound message content, and writing artifacts to disk. This mismatch is dangerous because users may authorize the skill for simple monitoring without realizing it stores data, inventories login-required targets, or processes credential-adjacent information, which expands privacy and security risk beyond the stated scope.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill advertises executable behavior involving file access and shell execution but does not declare any tool scope or permission boundaries in the manifest. That creates an unnecessary trust gap: operators cannot easily determine what capabilities the skill needs, and a runtime may grant broader access than expected, increasing the chance of unintended file modification or command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The guide explicitly instructs users to place usernames and passwords in a JSON file, which encourages plaintext credential storage without any warning, encryption, or secret-management controls. In a skill that scans many third-party bidding platforms, compromise of that file could expose multiple accounts and enable unauthorized access, data scraping, or account misuse.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes the skill as filtering 'power/electric bidding notices only,' but this file enumerates broad categories such as real estate, provincial SOEs, central enterprises, industry, and other enterprise procurement platforms. That expands the apparent monitoring scope well beyond power/electric bidding and indicates a semantic mismatch between the claimed purpose and the configured target set.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/gx_bidding_monitor.py (reported line 65)May include surrounding context.

python

def run(cmd, timeout=25):
    try:
        r = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
        return r.stdout, r.stderr, r.returncode
    except Exception as e:
        return '', str(e), 1

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script prints login-required platform details and, when present, outputs associated account identifiers to stdout. Exposing credential-related data in console output is unnecessary for basic monitoring and can leak sensitive information into logs, terminal history, shared sessions, or screenshots.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Authentication account information is written directly to stdout without any privacy guardrails. Console output may be captured by logs or visible to other users, making this a straightforward information disclosure issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script persists scan results and generated message content into the user workspace without explicit consent or disclosure. While this is normal application behavior in many tools, it can create privacy and retention risks if the collected data contains sensitive procurement details or if the workspace is broadly accessible.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill instructs users to place their own credentials into a configuration file but provides no warning about plaintext storage, access control, or secret-handling practices. In a tool that targets 50+ procurement platforms, this increases the likelihood of credential leakage through source control, local workspace exposure, backups, or logs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The module description and all user-facing CLI/help strings are fixed in Chinese, which can impose a language constraint on users without opt-in. The file does not state that the skill is intentionally restricted to a Chinese-speaking or Guangxi-specific operator audience.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: references/gx_websites.json:11