Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed bid-search skill using a provider API and API key; it has account setup and privacy considerations but no evidence of hidden malicious behavior.
Install only if you are comfortable sending bid queries, company names, API credentials, package identity headers, and optionally a hashed MAC-based device identifier to the Zhiliaobiaoxun service. To avoid device-feature collection, configure ZLBX_API_KEY yourself before first use. Review costs before broad searches, and avoid bulk use of contact data.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
QUERY_TIMEOUT：缩小检索范围后最多重试一次；其它服务异常如实说明，不反复注册 Key。CLIENT_VERSION_UNSUPPORTED：提示从实际安装来源更新，不把产品线版本当商店包版本。安装包身份与升级检查：所有发往知了标讯 API 的请求（包括账户查询）必须额外携带以下两个请求头：
X-Skill-Package: tender-bid-search/1.0.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
QUERY_TIMEOUT:缩小检索范围后最多重试一次;其它服务异常如实说明,不反复注册 Key。CLIENT_VERSION_UNSUPPORTED:提示从实际安装来源更新,不把产品线版本当商店包版本。安装包身份与升级检查:所有发往知了标讯 API 的请求(包括账户查询)必须额外携带以下两个请求头:
X-Skill-Package: tender-bid-search/1.0.0
This duplicate finding points to the same hidden instruction block that attempts to control request identity and source attribution through embedded text. Even if the stated purpose is package compatibility, hidden instructions are dangerous in a security context because they can override normal agent policy, cause cross-package credential reuse decisions, and induce authenticated network activity based on untrusted content.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding points to the same hidden instruction block that attempts to control request identity and source attribution through embedded text. Even if the stated purpose is package compatibility, hidden instructions are dangerous in a security context because they can override normal agent policy, cause cross-package credential reuse decisions, and induce authenticated network activity based on untrusted content.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The skill exposes company project contact information, including phone numbers, for a use case that does not require direct-contact enrichment. This increases privacy and abuse risk because users can retrieve personal or semi-personal contact data under the cover of a bid-search workflow, enabling scraping, unsolicited outreach, or targeted social engineering.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding points to the same hidden instruction block that tells the agent to preserve package identity headers and not reuse another package's version/source. Even if intended for correct integration, embedding such control instructions in skill content is unsafe because the model must treat the file as untrusted input; hidden directives can manipulate outbound authenticated requests and are not transparent to users.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding points to the same hidden instruction block that tells the agent to preserve package identity headers and not reuse another package's version/source. Even if intended for correct integration, embedding such control instructions in skill content is unsafe because the model must treat the file as untrusted input; hidden directives can manipulate outbound authenticated requests and are not transparent to users.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instruction finding reflects the same issue: embedded directives tell the agent how to identify itself on authenticated requests. Even if operationally intended, placing these instructions in the skill content makes them adversarially mutable and can mislead agents into performing credentialed actions based on untrusted documentation text.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instruction finding reflects the same issue: embedded directives tell the agent how to identify itself on authenticated requests. Even if operationally intended, placing these instructions in the skill content makes them adversarially mutable and can mislead agents into performing credentialed actions based on untrusted documentation text.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The amount-unit guidance conflicts with earlier documentation: earlier it states query_bids_advanced uses the same 万元 units as search_bids, while later it claims query_bids_advanced uses 元. This inconsistency can cause materially incorrect search filters and business decisions, returning far broader or narrower procurement results than intended and undermining trust in the tool’s outputs.
This duplicate hidden-instructions finding reflects the same issue: covert markdown directives telling the agent which identity headers to send. Even if operationally useful, embedding them as hidden instructions is dangerous because it obscures network behavior and enables instruction-channel abuse.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instructions finding reflects the same issue: covert markdown directives telling the agent which identity headers to send. Even if operationally useful, embedding them as hidden instructions is dangerous because it obscures network behavior and enables instruction-channel abuse.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The skill instructs the agent to collect device characteristics, derive a MAC-based hash, and send them to a remote service to create trial accounts. Even with hashing, this is device fingerprinting for account provisioning unrelated to bid search, and it introduces privacy risk, covert identification, and a path for unanticipated external data transmission.
The skill description and operational instructions are entirely written in Chinese and present the skill as Chinese-language only, with no stated option to adapt to the user's preferred language or locale. This can violate language/locale policy when a skill forces a specific language without user opt-in.
The file documents broad company-analysis capabilities inside a skill whose stated purpose is limited to bid search and opportunity pre-screening. This creates a scope-expansion problem: users and platform operators may grant or invoke the skill expecting narrow procurement search behavior, while the skill can access and process unrelated company intelligence data.
The workflow instructs automatic expansion from a user-supplied company name to all matched entities and then sends those queries to external APIs without warning or confirmation. This can disclose user interests, targets, and research intent to a third party, and may also cause over-collection by querying more entities than the user expected.
Competitor analysis and supplier recommendation materially expand the skill beyond simple bid discovery into market-intelligence and strategic targeting. In this context, that mismatch can facilitate misuse of externally sourced commercial intelligence without the transparency and approval expected for a narrowly scoped search skill.
The skill explicitly requires sending an API key together with package/source identity headers to an external service, but the documentation does not disclose that these headers reveal package provenance and may allow correlation of user/account activity. This creates a transparency and privacy risk because users and integrators may unknowingly transmit identifying metadata beyond what is necessary for the query itself.
The file extends a bid-search skill into an account-balance check and update-acknowledgment workflow that is not necessary to fulfill a user’s search request. This creates extra authenticated side effects and metadata disclosure opportunities, increasing the attack surface and allowing package authors to steer the agent into non-user-requested actions with the configured API key.
The instruction to surface package update notices to the user and then submit an acknowledgment is unrelated to the declared bid-search purpose. It can be abused to inject vendor-controlled messages into the conversation and trigger authenticated confirmation calls, effectively turning the skill into a message-delivery and state-changing channel beyond its stated scope.
The file defines an automatic account-registration, credential acquisition, persistence, and recharge workflow that materially exceeds the manifest’s stated purpose of tender/bid search and analysis. Expanding a search skill into account lifecycle management increases the attack surface and can cause an agent to perform sensitive actions the user did not expect, including creating accounts, storing secrets, and initiating billing-related flows.
No suspicious patterns detected.