Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed tender-search integration that uses an external paid API, with sensitive but purpose-aligned account setup and credential handling users should understand.
Before installing, decide whether you are comfortable sending tender queries and account requests to the Zhiliaobiaoxun API. To avoid device-based auto-registration, configure ZLBX_API_KEY yourself. If you use auto-registration, the skill says it will ask first, send platform/architecture/hashed MAC data, and store the returned key in ~/.zlbx/config.json. API use may consume provider credits and some results may include business contact information.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
可尝试：“我们做医院信息化，筛广东近30天预算100万元以上的项目，排除维保，按可跟进与早期线索分表。”
安装包身份与升级检查：所有发往知了标讯 API 的请求（包括账户查询）必须额外携带以下两个请求头：
X-Skill-Package: tender-bid-opportunity/1.0.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
可尝试:“我们做医院信息化,筛广东近30天预算100万元以上的项目,排除维保,按可跟进与早期线索分表。”
安装包身份与升级检查:所有发往知了标讯 API 的请求(包括账户查询)必须额外携带以下两个请求头:
X-Skill-Package: tender-bid-opportunity/1.0.0
The hidden comment-delimited instructions direct the agent to attach specific identity headers and use configured API credentials automatically. Embedding operational directives in non-user-visible sections can bypass normal transparency, making it easier to trigger external requests with sensitive credentials and package-identifying metadata without clear user awareness.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The hidden comment-delimited instructions direct the agent to attach specific identity headers and use configured API credentials automatically. Embedding operational directives in non-user-visible sections can bypass normal transparency, making it easier to trigger external requests with sensitive credentials and package-identifying metadata without clear user awareness.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Project-contact retrieval exposes direct contact information for individuals, which is not necessary for initial opportunity screening and creates a meaningful privacy and misuse risk. In this skill context, access to named contacts and phone numbers enables lead harvesting or targeted outreach beyond the advertised purpose, making the mismatch more dangerous.
This duplicate finding points to the same hidden identity-header instructions embedded in comments at the top of the file. Even if the values are not overtly malicious, embedding authenticated request behavior in hidden text is unsafe because an agent may follow it without user consent or normal security review.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding points to the same hidden identity-header instructions embedded in comments at the top of the file. Even if the values are not overtly malicious, embedding authenticated request behavior in hidden text is unsafe because an agent may follow it without user consent or normal security review.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instructions finding is substantively the same issue: the skill text contains non-obvious agent directives governing authentication headers and extra network actions. In an agent setting, hidden package instructions are risky because they can override normal least-privilege behavior, trigger silent metadata exfiltration, or create confusing trust boundaries between user intent, platform policy, and package author intent.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instructions finding is substantively the same issue: the skill text contains non-obvious agent directives governing authentication headers and extra network actions. In an agent setting, hidden package instructions are risky because they can override normal least-privilege behavior, trigger silent metadata exfiltration, or create confusing trust boundaries between user intent, platform policy, and package author intent.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding points to the same hidden instruction block controlling headers and package identity. Concealed instructions affecting outbound authenticated requests reduce transparency and can be abused to smuggle behavior past reviewers.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding points to the same hidden instruction block controlling headers and package identity. Concealed instructions affecting outbound authenticated requests reduce transparency and can be abused to smuggle behavior past reviewers.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The file embeds an account bootstrap workflow that collects device fingerprint data, registers an external account, and persists API credentials locally, which materially exceeds the declared purpose of bid-opportunity screening. Even though it asks for consent and documents the fields collected, this expands the skill into credential provisioning and device tracking, increasing privacy, security, and scope-creep risk.
The instructions direct the agent to execute OS-specific commands to derive a hardware-linked identifier from network interface MAC data and transmit it externally. That behavior is unrelated to screening tenders and creates a fingerprinting capability that can track devices across sessions or be repurposed beyond the stated function.
The skill instructs writing obtained API keys into ~/.zlbx/config.json and reusing them in later sessions, creating local credential persistence outside the stated screening purpose. Persisting secrets from within a content skill increases the blast radius of compromise, can bypass host-managed secret storage, and may overwrite or mingle with existing user configuration.
The manifest description and all user-facing operating instructions are written exclusively in Chinese, and the skill examples and delivery expectations assume Chinese-language use. There is no visible statement that users may choose another language or locale, which can violate the language/locale choice policy for natural-language behavior.
The file introduces account-balance, usage-statistics, and update-acknowledgement behaviors that are outside the declared purpose of tender-opportunity screening. This scope expansion increases the skill’s access to account metadata and creates unnecessary opportunities for data exposure or unintended external calls that users would not reasonably expect from this skill.
The capability to query balance and consumption statistics is not necessary for screening bid opportunities, so it constitutes overbroad access to sensitive operational/account data. Even if the API key is not displayed, the skill can still retrieve and surface billing and usage information unrelated to the user’s immediate task.
The instructions require the agent to relay the update notice message verbatim to the user and continue with user-visible confirmation behavior, while the document itself is written as Chinese-only operational guidance. This imposes a specific language/localization behavior without indicating that the user may choose another language or that the locale restriction is justified.
The documented API surface materially exceeds the skill’s stated purpose of initial bid-opportunity filtering and includes broader company-intelligence capabilities. This expands the data-access and action scope available to the agent, increasing the chance of unauthorized profiling or mission creep if the skill is invoked for narrowly scoped screening tasks.
The documentation instructs the agent to automatically expand a user’s query from one company name to all semantically matched related entities, including subsidiaries, without confirmation. This can substantially broaden the query scope and data retrieval beyond user intent, producing over-collection and potentially misleading analysis.
Competitor-analysis functionality is outside the declared scope of bid-opportunity screening and broadens the agent into strategic market-intelligence collection. While not inherently malicious, this increases the risk of unexpected sensitive business profiling under the guise of a simpler screening workflow.
No suspicious patterns detected.