T08 · Insecure Dependencies
Warning
- Location
scripts/install-deps.sh:26- Finding
Unpinned Python dependencies are installed from the active package index
- Content
View full analysis
- Remediation
View remediation
Security audit
Biaoshu Writer
Security checks for vulnerabilities and agentic risk
Overview
This looks like a legitimate Chinese bid-document generator, but it warrants review because it handles sensitive procurement files and includes under-scoped guidance that may affect confidentiality, supply chain safety, and document provenance.
Install only in a controlled workspace, review generated bid content before submission, avoid uploading tender documents to public OCR services unless your organization approves it, use pinned dependencies from trusted sources, and do not install fonts downloaded from unverified search results. Treat the automatic DOCX metadata rewrite and AI-trace removal as provenance-affecting behavior.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
scripts/check-font.sh:52- Finding
Font installation guidance directs users to an unspecified Internet source without integrity verification
- Content
View full analysis
Method 2: Download from the Internet- Search for "SimSun.ttf download"
- Download the resulting .ttf file
- Place it in
~/Library/Fonts/
- Remediation
View remediation
SimSun.ttf" | shasum -a 256 -c - ``` 4. If redistribution rights permit, distribute a reviewed font through a controlled release channel with signed release artifacts. 5. Prefer a trusted open-licensed alternative that can be obtained from an authenticated operating-system package repository. 6. Clearly distinguish existence checks from integrity checks; `ls -lh` must not be described as security verification. 7. Advise users not to install font files whose publisher and integrity cannot be verified. ]]>
other
Warning
- Location
scripts/parse_bid_files.py:109- Finding
Scanned bid documents may be disclosed to a third-party online OCR service
- Content
View full analysis
Q: The PDF cannot be parsed?If it is a scanned PDF without a text layer, OCR is required first.``` ### Technical Analysis When local extraction fails, the project recommends a public online OCR service. It does not warn users that uploading a document transfers its contents to a third party, nor does it require confirmation that the document is non-confidential. It also does not provide retention, jurisdiction, privacy, contractual, or data-processing guidance. Bid and procurement documents may contain commercial terms, technical designs, personal information, supplier data, or other restricted material. Sending such a document to an external OCR provider may violate organizational policy, confidentiality obligations, procurement rules, or data-protection requirements. The project does not automatically upload files, and no programmatic exfiltration was found. Disclosure occurs only if a user follows the recommendation and manually submits a file. ### Attack Path 1. A user attempts to parse a scanned bid PDF. 2. Local extraction fails a ...[truncated 932 chars]
Recommended: Adobe Acrobat / Online OCR- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The changelog explicitly states that convert_to_word.py rewrites Word metadata such as creator/description and timestamps, but this behavior is not surfaced as a security-relevant capability in the main description. Undisclosed metadata modification can hinder provenance tracking, confuse audit trails, and conceal document origin in procurement workflows where authenticity matters.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The changelog explicitly states that convert_to_word.py rewrites Word metadata such as creator/description and timestamps, but this behavior is not surfaced as a security-relevant capability in the main description. Undisclosed metadata modification can hinder provenance tracking, confuse audit trails, and conceal document origin in procurement workflows where authenticity matters.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The changelog explicitly states that convert_to_word.py rewrites Word metadata such as creator/description and timestamps, but this behavior is not surfaced as a security-relevant capability in the main description. Undisclosed metadata modification can hinder provenance tracking, confuse audit trails, and conceal document origin in procurement workflows where authenticity matters.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The changelog explicitly states that convert_to_word.py rewrites Word metadata such as creator/description and timestamps, but this behavior is not surfaced as a security-relevant capability in the main description. Undisclosed metadata modification can hinder provenance tracking, confuse audit trails, and conceal document origin in procurement workflows where authenticity matters.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The changelog explicitly states that convert_to_word.py rewrites Word metadata such as creator/description and timestamps, but this behavior is not surfaced as a security-relevant capability in the main description. Undisclosed metadata modification can hinder provenance tracking, confuse audit trails, and conceal document origin in procurement workflows where authenticity matters.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document declares Chinese as the page language with
lang="zh-CN", and the entire installation and usage flow is written only in Chinese without offering an alternate language or stating that the skill is intentionally limited to Chinese-speaking users. This can violate language/locale policy when a skill imposes a specific language by default rather than by user opt-in or documented regional scope.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill declares installation steps and an output path indicating local file reads/writes, but it does not declare any explicit tool scope or permissions boundaries. That creates an authorization gap: an agent may infer broader filesystem access than users expect, increasing the risk of unintended access to local documents during bid-processing workflows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
该技能具备 Read/Write/Edit 能力，但说明中未清楚提醒其会直接修改用户文本，也未要求在覆盖前确认。对于投标、技术文档等高价值内容，这种静默编辑可能导致措辞、证据强度或格式要求被改变，进而影响合规性、准确性和业务结果。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
该技能的触发条件“编辑或审阅文本，去除 AI 写作痕迹”过于宽泛，容易与普通润色、审校、改写等常见请求重叠，导致在用户并未明确要求时被自动调用。一旦触发，它会按预设规则系统性重写内容，可能改变原文语气、事实表述或合规措辞，带来非预期内容篡改风险。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Nearly all comments and terminal output are written only in Chinese, which imposes a specific language on users without opt-in or an alternative locale. This matches the language/locale policy violation criteria because the skill does not provide any user choice or clearly document a justified region-specific restriction.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh echo "🐧 Linux 安装方法：" echo "" echo " # 创建用户字体目录" echo " mkdir -p ~/.fonts" echo " cp SimSun.ttf ~/.fonts/" echo " fc-cache -fv" ;;
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The function and its docstring explicitly count only Chinese characters and ignore punctuation, English, and numbers, making the skill inherently language-specific. Elsewhere the script also labels its purpose as chapter word counting generally, but it does not offer a language choice or state that it is restricted to Chinese-language documents, which conflicts with the policy against forcing a specific language without opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module docstring, usage text, and user-facing messages are all written exclusively in Chinese, which constitutes a language-specific constraint in the skill's natural-language interface. The file does not offer an opt-in language choice or explain that the tool is intentionally limited to a Chinese-only environment.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module docstring, usage instructions, warnings, and returned status strings are all written in Chinese, which imposes a specific language on users. The file does not provide an opt-in language choice or explain that the skill is intentionally limited to a Chinese-speaking or region-specific context.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
This code file performs a user-facing file metadata disclosure via
ls -lh "$FONT_PATH", which reveals the exact path, size, permissions, and timestamps of a file in the user's home directory. Although it prints the result, the script header and usage text do not warn that local filesystem details will be displayed, so the disclosure lacks advance notice.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script's comments and user-visible echo messages are written in Chinese throughout, which effectively imposes a specific language on users. The file does not offer an opt-in choice of language or explain that the skill is intentionally limited to a Chinese-speaking or region-specific context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code file contains natural-language docstrings and CLI output entirely in Chinese, including the script description and usage text. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.