pitch比稿技能

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:26 AM UTC
• Version: 2.2.0

Overview

This business pitch skill needs review because it encourages personal profiling of evaluators and potentially misleading AI-generated pitch visuals.

Install only if you are comfortable with a forceful competitive-bidding assistant. Do not provide confidential insider information, private evaluator details, or unlawfully obtained records, and label any AI-generated visuals as concept mockups rather than completed work. Treat win-rate percentages as rough heuristics, not reliable probabilities.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

other

Warning

• Location: agents/information-agent.md:107

Finding

Invasive Profiling of Identifiable Decision-Makers

Content

View full analysis

Vulnerability Details

File Location: agents/information-agent.md, lines 107-161
Vulnerability Type: Privacy-invasive intelligence collection and psychological profiling
Risk Level: Medium

Vulnerable Instruction Snippet

text

Information acquisition strategy:

L1 — User-provided information:
  Ask the user for known information about decision-makers.

L2 — Public search:
  Search public speeches, interviews, and industry forum statements.

L3 — Career history:
  Search LinkedIn, Maimai, and industry reports for career history.

L4 — Industry inference:
  Infer characteristics from industry conventions and company attributes.

If the user provides a decision-maker's name:
1. Search recent public speeches and interviews to extract concerns,
   language style, and decision preferences.
2. Search career history to infer professional background and likely
   decision tendencies.
3. Search the employer's recent strategic direction to infer KPI pressure.

The resulting profile includes:
- Decision style
- KPI pain points
- Upward, downward, and lateral pressure
- Psychological safety zone
- Fear points
- Expectations

The snippet is an English translation of the operational instructions at the cited location.

Technical Analysis

The Skill instructs the agent to build individualized dossiers about named people by combining public statements, employment history, company information, and user-supplied intelligence. It then derives psychological characteristics such as fears, pressure, safety zones, and likely decision behavior.

Public professional information may legitimately support role-based stakeholder analysis. However, combining it into inferred psychological profiles for targeted persuasion creates a privacy and misuse risk. The derived conclusions may also be inaccurate because the Skill encourages inference from broad proxies such as previous employment, industry, an ...[truncated 1417 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict stakeholder analysis to role-relevant professional responsibilities, published organizational authority, and confirmed evaluation criteria.
2. Prohibit inference of personal fears, psychological vulnerabilities, private pressure, or personality from career history.
3. Require explicit user confirmation before researching a named individual.
4. Use aggregate role profiles by default, such as “procurement lead” or “brand director,” rather than named-person dossiers.
5. Clearly distinguish verified facts, user claims, and model inferences.
6. Do not infer protected or sensitive traits.
7. Add data-minimization rules to inter-agent handoffs and exclude names unless operationally necessary.
8. Warn users not to provide confidential insider information, private contact data, or unlawfully obtained personal records.
9. Provide a deletion or non-retention statement for supplied stakeholder information.

T09 · Insecure Skill Coding Practices

Error

• Location: agents/expression-agent.md:63

Finding

Instructions Encourage Deceptive Representation of AI-Generated Concepts

Content

View full analysis

Vulnerability Details

File Location: agents/expression-agent.md, lines 63-72
Vulnerability Type: Deceptive synthetic-content presentation
Risk Level: High

Vulnerable Instruction Snippet

text

Phase 4: Tangible Impact — AIGC Demo

Use generative AI for images or video to rapidly create the first visual
impression of the implemented proposal. Use highly finished demos rather
than sketches to raise the competitive barrier and create an illusion of
execution capability.

The objective is to show the client not merely text on slides, but what the
implemented proposal would really look like.

Quality requirements:
- High degree of completion
- It should look like an already completed case, not a concept image

The snippet is an English translation of the operational instructions at the cited location.

Technical Analysis

The instruction expressly directs the model to create an “illusion of execution capability” and make speculative AI-generated concepts resemble completed case work. No corresponding rule requires disclosure that the assets are synthetic mock-ups, prevents them from being represented as prior work, or requires validation that the proposed execution is feasible.

The issue is systemic because the generated assets are subsequently packaged into the final Pitch Package by the Delivery Agent. An evaluator could therefore mistake conceptual media for an implemented campaign, validated prototype, or evidence of the bidder's prior delivery capability.

This is an insecure Skill-design practice because the operational configuration deliberately encourages materially misleading output.

Attack Path

1. The Strategy Agent proposes an unimplemented campaign or experience.
2. The Expression Agent generates polished synthetic images or video prompts.
3. The generated media is designed to resemble completed case work rather than a concept.
4. The Delivery Agent associates the m ...[truncated 836 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all instructions to create an “illusion” of capability or make concepts resemble completed cases.
2. Require a visible label on every generated asset, such as “AI-generated concept visualization — not completed work.”
3. Require proposal decks to distinguish among prior work, prototypes, mock-ups, simulations, and planned deliverables.
4. Prohibit using generated assets as evidence of prior experience or validated performance.
5. Require human review of feasibility, production cost, timing, licensing, accessibility, and brand compliance.
6. Require citations and client authorization for genuine case studies.
7. Add consistency checks ensuring that synthetic visuals do not imply resources, locations, endorsements, interfaces, or product capabilities that do not exist.
8. Preserve metadata or disclosure notes when generated materials are transferred into the Delivery Agent's package.

other

Note

• Location: README.md:118

Finding

Remote Promotional Image Causes an Unnecessary Third-Party Request

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 118-122
Vulnerability Type: Third-party tracking and promotional redirect
Risk Level: Low

Vulnerable Code Snippet

html

## Join the Group Chat

<div align="center">
  <img src="https://qomob.ai/xskill.jpg" width="600" alt="XSkill">
</div>

The heading is translated into English; the HTML element and remote URL are unchanged.

Technical Analysis

The README embeds an image from https://qomob.ai/xskill.jpg. Markdown viewers that permit remote images will contact that third-party domain when the document is rendered.

This is not remote payload execution: the referenced object is an image, and no evidence shows that the project executes code from the domain. It is also not an insecure software dependency. The risk is an unnecessary external request tied to an unrelated promotional group-chat section.

Depending on the renderer and request configuration, the remote server may observe the viewer's IP address, request time, User-Agent, and potentially referrer information. The remote content can also change after repository review.

Attack Path

1. A user opens the README in a renderer that automatically loads remote images.
2. The renderer requests https://qomob.ai/xskill.jpg.
3. The third-party server receives request metadata.
4. The server can return replacement image content that differs from the content present during review.
5. The image may direct users toward an external promotional channel.

Impact Assessment

No local code execution, file access, credentials, or system privileges are obtained based on the audited content. The potential scope is limited to:

• Disclosure of ordinary network metadata to the third-party host.
• Mutable promotional content displayed inside project documentation.
• Exposure to an external social or marketing funnel unrelated to the Skill's core operation.

Remediation

View remediation

Remediation Suggestions

1. Remove the promotional section if it is not required for the Skill.
2. Store the image in the repository and reference it with a relative path.
3. If a remote resource is essential, document the destination and associated privacy implications.
4. Pin externally hosted documentation assets by integrity-controlled release artifacts where supported.
5. Do not place QR codes or community invitations in operational output templates.
6. Configure documentation renderers to block remote images by default in sensitive environments.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/decision-engine.md:91

Finding

Broken Win-Rate Floor Formula Produces Misleading Probability Estimates

Content

View full analysis

Vulnerability Details

File Location: references/decision-engine.md, lines 91-109
Vulnerability Type: Incorrect risk-scoring algorithm
Risk Level: Medium

Vulnerable Code Snippet

text

WinRate = max(
  floor_multiplier × weighted_avg,
  weighted_avg
)

weighted_avg = (
  Strategy Fit × 0.30 +
  Decision-Maker Fit × 0.25 +
  Competitor Differentiation × 0.20 +
  Execution Credibility × 0.15 +
  Relationship/Price × 0.10
)

floor_multiplier = minimum of the five scores / 10

Multiplicative floor protection:
If any dimension has an extremely low score, the win rate will be reduced
close to that dimension's level. This prevents an inflated result where the
strategy scores highly but cannot be executed.

The formula is preserved while its dimension names and explanatory text are translated into English.

Technical Analysis

Assuming each dimension is scored from 0 to 10, floor_multiplier is between 0 and 1. Therefore:

text

floor_multiplier × weighted_avg <= weighted_avg

The max() expression always selects weighted_avg. The claimed multiplicative protection is consequently dead logic and never lowers the score.

There is also a scale ambiguity: the weighted average of five 0–10 scores remains on a 0–10 scale, while downstream output presents a percentage. The documented formula does not specify the required conversion to 0–100.

The Decision Agent packages the result as a “Win Rate” percentage and the Delivery Agent uses it in a decision report and optimization roadmap. Although evidence-quality warnings exist, the output remains an uncalibrated heuristic rather than a statistically validated probability.

Attack Path

1. Four dimensions receive high scores while one critical dimension receives a very low score.
2. The minimum score produces a multiplier below one.
3. Multiplying the weighted average lowers the first candidate value.
4. max() ...[truncated 991 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the formula with an explicitly intended model. If the minimum dimension must proportionally reduce the score, use:

   text

   adjusted_score = weighted_avg × floor_multiplier
   

2. If a bounded floor or cap is intended, document it mathematically and avoid the ambiguous term “floor protection.”

3. Define score units and conversion explicitly:

   text

   percentage_score = adjusted_score × 10
   

4. Add unit tests covering minimum scores of 0, 2, 5, and 10.

5. Add monotonicity tests proving that lowering any input cannot increase the result.

6. Rename the output “heuristic competitiveness score” unless it is calibrated against historical bid outcomes.

7. Provide uncertainty intervals and prohibit unsupported precision.

8. Require historical validation before estimating optimization lifts.

9. Display assumptions and evidence quality beside every score in the final package.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is configured to trigger on extremely broad phrases like '帮我做个提案', '客户要方案', and '怎么才能赢', which overlap with many ordinary business-assistance requests outside the intended competitive pitch context. This can cause accidental invocation in unrelated conversations, leading the agent to adopt a highly specialized, adversarial win-focused behavior that may steer outputs toward manipulative or inappropriate competitive tactics without clear user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The README is written predominantly in Chinese and does not state that users may request another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The loading protocol and the rest of the document are written as mandatory operational instructions in Chinese, indicating a default language requirement. The only conditional language handling mentioned is loading bilingual templates when the user asks in English, but the file does not explicitly offer a language choice or user opt-in for the skill itself.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown explicitly requires that AIGC demo prompts 'must be English,' which imposes a fixed language constraint. Under the policy, forcing a specific language without user choice or a clear documented regional/compliance justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file includes a general description of what the skill does, but it does not specify concrete trigger phrases, scope boundaries, or negative examples for when the skill should not be used. Under the vague-trigger rule for markdown files, this makes activation conditions overly ambiguous and may cause unintended invocation in broad business-analysis contexts.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly solicits insider information about decision-makers, including whether the user has an internal source who can provide information. In the context of competitive bidding, this encourages collection and use of non-public competitive intelligence about evaluators, which can facilitate unethical procurement manipulation, privacy violations, or misuse of confidential business information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The eval requires Chinese analysis output when the user may not have explicitly chosen Chinese, which can override user language preference and create an unnecessary constraint on model behavior. In this skill, that mainly risks reduced usability, misalignment with user expectations, and brittle behavior in multilingual contexts rather than direct security compromise.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger eval includes single-word positives like 'pitch' and '比稿', which are highly polysemous and can match many benign contexts. In a skill that auto-activates competitive bidding support, such broad triggers can cause frequent false activations, routing unrelated requests into the skill and potentially producing inapplicable or sensitive strategic guidance.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The English short-query example 'help me win this pitch next week' lacks constraints tying 'pitch' to the intended agency/client competitive proposal scenario. Because 'pitch' is also common in fundraising, sales, startup, internal presentation, and media contexts, this training data broadens the trigger boundary and increases the chance of misclassification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

SQP-3 applies to all file types and flags natural-language policy issues such as forcing a specific language without user opt-in. This markdown file presents all instructions and methodology content only in Chinese, while the file itself does not state that it is region-specific or provide an alternative language option.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Line L331 states that prompts 'must be in English' because certain tools understand English better. This is a natural-language locale policy constraint that forces a specific language without user opt-in, and the file does not present it as optional or region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file title and all instructional content are written in Chinese, and nowhere in the document is there an indication that users may choose another language or that the Chinese-only requirement is region-specific. Under the policy, a skill that effectively mandates a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README embeds an external image URL, which can cause clients rendering the markdown to make unsolicited network requests and disclose viewer metadata such as IP address, user agent, and access timing. In a skill ecosystem, this also creates a tracking surface and a dependency on third-party content that can change independently of the reviewed package.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The line states that all agent outputs switch to English whenever the user's input language is English. This imposes a language-selection policy automatically rather than offering the user a choice or opt-in, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.