Security audit
Security checks for vulnerabilities and agentic risk
The skill is not clearly malicious, but it should be reviewed because it can create and manage a vendor account, collect a hashed device identifier, store an API key locally, and expose broader business-intelligence/contact lookups beyond simple bid tracking.
Install only if you are comfortable using the Zhiliaobiaoxun API with your account credentials, allowing optional consent-based device fingerprinting for auto-registration, and letting the skill store an API key in ~/.zlbx/config.json. Prefer manually configuring ZLBX_API_KEY if you want to avoid the auto-registration and local persistence flow, and be cautious with contact, competitor, and broad market-analysis queries because they go beyond simple project timeline lookup.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
可尝试：“追踪这个公告对应项目，从采购意向到最新结果按时间列出来，说明是否有更正及候选人和最终中标方是否一致。”
安装包身份与升级检查：所有发往知了标讯 API 的请求（包括账户查询）必须额外携带以下两个请求头：
X-Skill-Package: tender-bid-tracker/1.0.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
可尝试:“追踪这个公告对应项目,从采购意向到最新结果按时间列出来,说明是否有更正及候选人和最终中标方是否一致。”
安装包身份与升级检查:所有发往知了标讯 API 的请求(包括账户查询)必须额外携带以下两个请求头:
X-Skill-Package: tender-bid-tracker/1.0.0
This duplicate finding points to the same hidden instruction block that tells the agent how to authenticate requests and what extra actions to take during a session. Such embedded control text is risky because it can override expected least-privilege behavior and trigger authenticated requests or acknowledgments the user did not ask for. Given this skill's use of an API key and vendor-specific headers, the hidden instructions create a meaningful risk of covert or unnecessary API interactions.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding points to the same hidden instruction block that tells the agent how to authenticate requests and what extra actions to take during a session. Such embedded control text is risky because it can override expected least-privilege behavior and trigger authenticated requests or acknowledgments the user did not ask for. Given this skill's use of an API key and vendor-specific headers, the hidden instructions create a meaningful risk of covert or unnecessary API interactions.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The contact lookup endpoint gives access to project contact information, including phone numbers that may be complete for paid accounts. For a project-tracking skill this is unnecessary access to personal/contact data and could enable targeted outreach, scraping, or privacy-invasive enrichment.
This duplicate hidden-instructions finding points to the same concealed request-identity block that directs credentialed external requests with package-specific headers. Even if intended for integration consistency, embedding such instructions in hidden comments creates a non-transparent control channel that can be abused or can bypass normal user understanding of how their credentials are used.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instructions finding points to the same concealed request-identity block that directs credentialed external requests with package-specific headers. Even if intended for integration consistency, embedding such instructions in hidden comments creates a non-transparent control channel that can be abused or can bypass normal user understanding of how their credentials are used.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This file documents market-analysis APIs such as top purchasers, suppliers, brands, and pricing that materially exceed the skill’s declared purpose of tracking a specific tender/project timeline. That scope expansion can enable undisclosed lead generation, competitor intelligence, and broader data access under credentials the user may have granted only for project-tracking workflows.
The documentation explicitly promotes precise customer acquisition, competitor analysis, and price-reference use cases, which are unrelated to the stated tender-progress tracking purpose. This mismatch increases the risk of unauthorized or unexpected data processing and social-engineering of consent, because users may invoke the skill believing it only performs narrow timeline verification.
This duplicate finding flags the same hidden instruction region that prescribes exact identity headers and package/source metadata for every API request. Such hidden operational directives are dangerous because an LLM may prioritize them over higher-level safety expectations, causing silent propagation of metadata and extra network actions that the user did not explicitly request.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding flags the same hidden instruction region that prescribes exact identity headers and package/source metadata for every API request. Such hidden operational directives are dangerous because an LLM may prioritize them over higher-level safety expectations, causing silent propagation of metadata and extra network actions that the user did not explicitly request.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding reflects the same hidden-instruction issue: agent-readable but user-invisible directives at the top of the file tell the system how to authenticate and identify itself to an external API. Such instructions create a prompt-injection surface and can cause unauthorized or opaque request shaping when the agent follows untrusted document content.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding reflects the same hidden-instruction issue: agent-readable but user-invisible directives at the top of the file tell the system how to authenticate and identify itself to an external API. Such instructions create a prompt-injection surface and can cause unauthorized or opaque request shaping when the agent follows untrusted document content.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding points to the same hidden instruction region controlling request headers and package identity. Regardless of formatting normalization, the issue remains that concealed content is being used to steer agent behavior in a security-sensitive way.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding points to the same hidden instruction region controlling request headers and package identity. Regardless of formatting normalization, the issue remains that concealed content is being used to steer agent behavior in a security-sensitive way.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The document introduces a full account lifecycle outside the stated tender-tracking purpose: automatic registration, device fingerprint collection, local credential storage, and recharge/login flows. Even with a consent prompt, this expands the skill into credential management and host data collection, increasing privacy, security, and abuse risk well beyond what users would reasonably expect from a bid-query skill.
The file instructs the agent to run shell/PowerShell commands to collect OS, CPU architecture, and a MAC-derived identifier, then transmit them for account creation. This is host fingerprinting unrelated to the skill's stated project-tracking function, and it creates privacy and tracking risk while normalizing command execution on the user's machine for nonessential purposes.
The skill description, instructions, examples, and expected outputs are entirely written in Chinese and consistently assume Chinese-language usage, but nowhere offers users a language/locale choice. Under the policy rule, a skill that effectively forces a specific language without opt-in is a natural-language policy violation unless the restriction is explicitly justified as region-specific.
The skill manifest describes tender/project tracking, but this file adds account-balance and consumption-query features against the same vendor API. That scope expansion increases the skill's access to billing and account telemetry without clear user expectation, which can expose sensitive operational metadata and create permission creep. In this context, the extra capability is not inherently malicious, but it is security-relevant because it broadens what the skill can do with the configured API key.
L098 requires the agent to relay the skill_update_notice message verbatim to the user. Because the file is entirely Chinese and provides no opt-in or alternative locale handling, this instruction can force a specific language on users regardless of their preferred language.
The file exposes broad company-analysis capabilities far beyond the skill’s declared purpose of tracking tender/project progress. This expands the accessible data domain and increases the chance that the agent will retrieve or infer unrelated business intelligence, violating least-privilege and user expectation boundaries.
The documentation instructs automatic expansion from a single company name to all related headquarters/subsidiaries without user-visible confirmation. This silently broadens query scope, can materially change results, and may expose data about entities the user did not intend to include.
Competitor analysis is materially different from simple tender-progress tracking and enables strategic intelligence gathering about overlap, customers, products, and regions. In this skill context, that creates an unjustified expansion from record lookup into competitive profiling.
No suspicious patterns detected.