Gx Bidding Monitor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:56 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent bidding-monitoring purpose, but it ships plaintext third-party account passwords, personal contact data, and an electronic-seal PIN in its artifacts.

Do not install or publish this version as-is. Treat every bundled password, sub-account credential, personal contact detail, and seal PIN as exposed; rotate them, remove them from the package and history, and replace them with secret references or user-supplied credentials before use. Also review the cron/WeChat destination and local output retention so monitoring results go only to intended recipients.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: references/gx_websites.json:136

Finding

Plaintext Credentials and Personal Data Committed to the Skill

Content

View full analysis

Vulnerability Details

File Location: references/gx_websites.json:136-241; duplicated in references/config-guide.md:202-301; partial account and credential disclosure in SKILL.md:84-102
Vulnerability Type: Hardcoded secrets and plaintext sensitive information
Risk Level: High

Representative exact excerpts from references/gx_websites.json:

json

"account": "WN141588",
"password": "wndl141588",

json

"account": "310150717",
"password": "Wndl717400!@!",

json

"account": "WNDL822",
"password": "Weineng13579!",
"phone": "19968289744",

The affected records also contain additional platform passwords, sub-account credentials, telephone numbers, email addresses, contact identities, a business-network identifier, and an electronic-seal PIN. Many of these values are duplicated verbatim in references/config-guide.md.

Technical Analysis

Authentication secrets are embedded directly in repository-controlled JSON and Markdown files. Any person, automation system, package registry, backup service, or build process with read access to the Skill can recover the credentials without decrypting or resolving an external secret reference.

Duplicating credentials across configuration and documentation expands the disclosure surface and makes secure rotation more difficult. Removing the values only from the latest revision may also be insufficient because source-control history, cached Skill packages, backups, and previously distributed archives can retain them.

The executable script currently does not automatically submit these passwords. Nevertheless, the exposed records pair account identifiers with target platform URLs, making them directly actionable outside the script. The --auth-only path at scripts/gx_bidding_monitor.py:272-278 additionally prints account identifiers, although it does not print passwords.

Credential validity and successful authentication were not tested. Cons ...[truncated 1843 chars]

Remediation

View remediation

Remediation Suggestions

1. Immediately rotate every password, sub-account password, and electronic-seal PIN contained in the affected files.
2. Revoke existing sessions, recovery tokens, and remembered devices where supported.
3. Review authentication, account-change, bidding, submission, and electronic-seal audit logs for unauthorized activity.
4. Remove credentials and unnecessary personal data from references/gx_websites.json, references/config-guide.md, and SKILL.md.
5. Purge the values from source-control history, release archives, package caches, build artifacts, and backups where operationally possible. Treat all previously published values as compromised even after deletion.
6. Store secrets in an approved secret manager, operating-system credential store, or protected environment variables. Configuration files should contain only secret identifiers, such as secret_ref, rather than secret values.
7. Grant the runtime access only to the specific secrets it requires and apply restrictive filesystem permissions to generated or local configuration.
8. Mask account identifiers in --auth-only output unless full display is explicitly required and the output channel is trusted.
9. Add automated secret scanning to pre-commit hooks and continuous integration, and block releases when credentials or high-risk personal data are detected.
10. Enforce unique passwords, multi-factor authentication, login alerts, and least-privilege platform roles to limit the effect of future disclosure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Context-Inappropriate Capability

Critical

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This file contains plaintext usernames, passwords, personal contact details, and even seal/signing credentials, which are highly sensitive secrets. If accessed by unauthorized users, they could enable account takeover, procurement fraud, impersonation, privacy violations, and potentially legally binding actions on external bidding platforms.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared purpose says the skill only monitors and filters power-related bidding notices, but the document also exposes login-required platform account details, covers many non-power-specific platforms, and describes persistence/output behavior such as local message files and WeChat push preparation. This mismatch undermines informed consent and can conceal broader data collection, credential handling, and exfiltration-adjacent behavior from users or platform operators.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill documentation lists login-required platforms together with account information, but provides no strong user-facing warning, consent model, or handling policy for those credentials and associated personal data. In a scraping/monitoring context, exposing procurement-platform accounts is especially risky because the skill may encourage reuse of sensitive business identities across many third-party sites.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest says the skill covers 50+ sites but '仅筛选电力类标讯，非电力行业一概不采集不提示' (non-power industries are not collected or alerted). This config guide, however, defines full monitoring coverage across broad non-power categories such as real estate, transportation, telecom, banking, aviation, steel, and general enterprise procurement platforms, indicating the skill is intended to collect from sectors beyond the manifest's narrowly claimed scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide labels government public resource trading centers as '全量采集' and later marks them as part of the '每日固定扫描（必扫）'. That is inconsistent with the manifest promise that only power-related notices are collected and that non-power industries are categorically not collected or prompted.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This file contains numerous plaintext passwords, account names, phone numbers, emails, and other operational login details for third-party services. Exposure of these secrets would allow unauthorized access to external procurement systems, compromise linked personal accounts, and potentially enable fraud, impersonation, or downstream access to business data and workflows.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest description states the skill covers 50+ websites but 'only filters power-related bid notices' and does not collect or alert on non-power industries. This file's declared monitoring scope explicitly includes real estate, state-owned enterprise, central enterprise, industry-general, and other enterprise procurement platforms, showing the skill is configured to monitor substantial non-electricity sources rather than only power-sector sources.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The embedded login-account inventory materially expands the skill from passive monitoring into credentialed access across many third-party platforms, including ones outside the stated scope. This creates unauthorized exposure of sensitive operational accounts and indicates the skill is storing high-value access data unrelated to its minimally described purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill advertises executable shell commands, file reads, and file writes, but does not declare any explicit tool scope or permission boundaries. This creates a least-privilege failure: an agent or reviewer cannot easily tell what the skill is allowed to access, increasing the chance of unintended filesystem changes, credential exposure, or command execution beyond the user’s expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

All user-facing description and operating instructions are written only in Chinese, and the skill does not indicate that users may choose another language or that the locale restriction is intentional and justified. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documentation warns not to commit sensitive account passwords, yet the same skill file includes account identifiers and apparent credentials or credential-linked personal data. Embedding secrets and login data in repository documentation materially increases the risk of credential theft, account takeover, privacy violations, and reuse attacks across external procurement platforms.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document keeps a detailed credential ledger for many external platforms while also normalizing account management as part of the skill artifacts. Even if the current version does not auto-login, storing live usernames, passwords, phone numbers, and verification-linked accounts in a repository-accessible document creates immediate credential exposure risk and enables account takeover or unauthorized procurement-platform access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file states that daily results are saved as JSON and WeChat messages are generated/sent, which affects data handling and external transmission. The note section mentions WeChat dependency and historical data retention, but it does not clearly warn users that monitored data will be stored and pushed through a messaging channel as part of normal operation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The top-level description is entirely in Chinese and frames the dataset specifically around Guangxi-focused procurement monitoring, but the file provides no note that this language/locale restriction is intentional, optional, or region-specific by design. Under the policy rule, a forced language or locale without opt-in or explicit justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/gx_bidding_monitor.py (reported line 65)May include surrounding context.

python

def run(cmd, timeout=25):
    try:
        r = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
        return r.stdout, r.stderr, r.returncode
    except Exception as e:
        return '', str(e), 1

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The --auth-only path prints all login-required platforms and any configured account identifiers directly to stdout, regardless of whether they are relevant to the claimed electric-only filtering scope. This can disclose sensitive operational metadata or credentials into terminal history, logs, or shared execution records, contradicting the skill's stated minimization behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Printing account information for authentication-required sites to stdout can leak sensitive data through terminal scrollback, shell history capture, CI logs, remote session recordings, or centralized logging. Because these are authentication-related fields, even partial identifiers materially increase exposure and can aid credential abuse or reconnaissance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This skill documentation and configuration are fully Chinese-language and specify Asia/Shanghai scheduling context, which may impose a language/locale assumption on users without opt-in. The file does not indicate that the locale is optional or that the skill is intentionally restricted to a China-specific user base.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The top-level docstring describes the capability as keyword filtering plus WeChat message push. In implementation, the script formats a message, writes it to a local text file, and prints it to stdout, but contains no actual WeChat delivery logic. This is a direct mismatch between documented behavior and actual code behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script persistently writes scan results and generated message content into a workspace directory without notice, consent, retention controls, or permission hardening. In a monitoring context, this may expose browsing-derived business intelligence or source URLs to other local users, backup systems, or later processes that can access the workspace.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The comment labels this section as 'WeChat message', which in the context of the module docstring suggests outbound push behavior. The implementation only serializes the message to a file under the workspace and echoes it to the console. That is a documentation-to-code contradiction, not merely an omitted detail.

Content

No source excerpt is available for this finding.