Bidding Doc Domain

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:17 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Chinese bidding-document reference, but it tells the agent to automatically install and load another skill without clear user consent, source pinning, or verification.

Install only if you are comfortable with the agent adding and loading universal-task-os. Prefer requiring explicit approval before installation, using a verified publisher/source and pinned version, and falling back to read-only reference mode when the dependency is missing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Automatic Installation and Loading of an Unpinned External Skill Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–35
Vulnerability Type: Untrusted and unpinned dependency installation
Risk Level: Medium

Vulnerable Code Snippet

The following is an English translation of the complete affected instruction block:

text

Loading check process (executed each time the skill is activated):

1. Check whether the universal-task-os skill is installed.
2. If it is not installed, automatically install the universal-task-os skill.
3. If installation succeeds, load UTOS at the same time and execute according to this skill's usage rules.

A related instruction at SKILL.md:51 reiterates that the dependency must be detected and installed whenever the skill is activated:

text

Dependency check: On activation, detect and install UTOS according to the process above.

Technical Analysis

The skill directs the agent to install and load universal-task-os automatically whenever the dependency is absent. It does not specify:

• An approved package registry or repository
• A canonical publisher or namespace
• An immutable version, commit hash, or package digest
• Cryptographic signature or checksum verification
• A user-consent step before installation
• A review or sandbox boundary before loading the installed skill

Consequently, dependency resolution is based only on the mutable name universal-task-os. If the relevant registry, repository, package namespace, account, or resolution mechanism is compromised or ambiguous, an attacker-controlled component could satisfy that name. The instruction then directs the agent to load the installed component, extending trust to content that was not included in this audited project.

The repository does not contain an installation implementation, remote URL, or executable script, so this finding does not establish that arbitrary code is currently downloaded or executed by the files in this package alone. The ris ...[truncated 1904 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic dependency installation from the activation workflow. If the dependency is absent, remain in read-only mode and provide explicit installation instructions instead.

2. Require informed user approval before any package or skill installation.

3. Pin the dependency to an immutable version and, where supported, an exact source commit.

4. Specify an allowlisted registry or repository and the verified publisher identity.

5. Verify a cryptographic signature or published checksum before installation and fail closed when verification is unavailable.

6. Review the dependency contents before loading it, including its instructions, scripts, transitive dependencies, and requested permissions.

7. Install and run the dependency in a restricted sandbox with minimal filesystem, network, credential, and tool access.

8. Record the resolved source, version, digest, verification result, and user authorization in an audit log.

9. Prefer a compatibility declaration such as the following:

   text

   This skill optionally integrates with a reviewed, pinned release of universal-task-os.
   If that dependency is unavailable, use read-only reference mode. Do not install
   dependencies without explicit user approval and successful source and integrity verification.
   

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list is broad enough to activate on ordinary discussion of bidding topics, which can cause the skill to engage outside clear user intent. In this skill, that matters because activation can lead into structured document-generation behavior and dependency handling, increasing the chance of unintended workflow execution or inappropriate responses in routine conversations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly directs automatic installation of a dependency during activation without prior user consent or a warning about the action. That creates a supply-chain and autonomy risk: merely invoking or matching the skill could cause additional code or capabilities to be fetched and loaded, expanding trust boundaries without the user's informed approval.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The entire skill reference and usage guidance are written only in Chinese, including headings, process instructions, and user guidance, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The entire skill reference is written as a prescriptive Chinese-language specification and does not indicate that users may choose another language or locale. Under the policy rule for language/locale constraints, this can be a natural-language policy issue when no opt-in or justification is provided.

Content

No source excerpt is available for this finding.