Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 调用 `scripts/main.js` 导出的 `execute(input)` 函数：
Security audit
采招网招标查询
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed bidcenter.com.cn search helper that makes purpose-aligned public procurement queries, with only minor activation-scope cautions.
Install this if you expect Chinese-language bidcenter.com.cn tender searches. Be aware that broad procurement terms may trigger the skill and send your search keywords, region, type, time range, page, and page size to bidcenter.com.cn.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 调用 `scripts/main.js` 导出的 `execute(input)` 函数：
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill documents network-backed behavior and explicitly calls a JavaScript entrypoint, but it does not declare any tool scope such as permissions or allowed-tools. That creates a governance gap: the runtime may grant broader capabilities than users or reviewers expect, reducing transparency and increasing the chance of unintended external requests or future privilege creep.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger list includes broad, generic terms related to procurement and bidding, which can cause the skill to activate for ordinary user requests that may not specifically intend to use this integration. Over-broad activation can route user queries to an external networked skill unexpectedly, increasing privacy and integrity risk through unnecessary third-party access.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The auto-activation section says the skill triggers whenever users mention listed scenarios, but those scenarios are broad and common. In context, this is more dangerous because the skill performs external queries; ambiguous activation can send user-provided search terms to a third-party service without sufficiently clear user intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This file uses Chinese exclusively in comments, parameter descriptions, log messages, and returned error/status text, such as the retry log and validation errors. Under the policy, a skill should not force a specific language or locale unless it offers opt-in choice or clearly documents a justified regional constraint; that justification is not present in this file.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 85% confidence
- Finding
The single-word trigger '招标' is extremely short and generic, making accidental activation likely. While lower severity on its own, it compounds the external-query behavior of the skill by increasing the chance that unrelated conversations trigger third-party lookups.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The skill metadata and user-facing instructions are presented in Chinese, which may impose a language-specific experience without stating that the skill is intended only for Chinese-speaking users or offering an opt-in language choice. Under the stated policy, forcing a specific language without user choice can be a natural-language policy concern.
- Content
Static analysis
No suspicious patterns detected.