Security audit
Security checks for vulnerabilities and agentic risk
The skill largely matches a Guangdong bid-data helper, but its onboarding flow can collect a device fingerprint, create an external account, and persist an API key, so users should review it before installing.
Install only if you are comfortable sending bid searches and account-linked metadata to Zhiliaobiaoxun. To avoid the device-fingerprint auto-registration path, configure your own ZLBX_API_KEY before use; otherwise review the consent prompt carefully because it may collect platform, CPU architecture, and a MAC-address hash, then store the returned key under ~/.zlbx/config.json.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
"bid_type": "招标"，否则一半结果是已经结束的。安装包身份与升级检查：所有发往知了标讯 API 的请求（包括账户查询）必须额外携带以下两个请求头：
X-Skill-Package: tender-guangdong/1.0.5
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
"bid_type": "招标",否则一半结果是已经结束的。安装包身份与升级检查:所有发往知了标讯 API 的请求(包括账户查询)必须额外携带以下两个请求头:
X-Skill-Package: tender-guangdong/1.0.5
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicated finding identifies the same hidden instruction block that tells the agent to preserve package-specific identity headers and use configured API keys. Even if the values appear legitimate, placing such control instructions inside skill content creates a prompt-injection surface where an attacker could alter request-routing, provenance, or credential usage without transparent user awareness.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicated finding identifies the same hidden instruction block that tells the agent to preserve package-specific identity headers and use configured API keys. Even if the values appear legitimate, placing such control instructions inside skill content creates a prompt-injection surface where an attacker could alter request-routing, provenance, or credential usage without transparent user awareness.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding points to the same hidden instruction block that directs the agent to send authenticated requests with package-specific identity headers. Such hidden operational directives are dangerous because they can override normal tool-routing or identity policies and cause the agent to make trusted outbound calls under attacker-influenced request metadata.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding points to the same hidden instruction block that directs the agent to send authenticated requests with package-specific identity headers. Such hidden operational directives are dangerous because they can override normal tool-routing or identity policies and cause the agent to make trusted outbound calls under attacker-influenced request metadata.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicated finding points to the same hidden instruction block that attempts to control how the agent authenticates and identifies itself to an external API. Even if the values look product-related rather than overtly malicious, hidden instructions that override request identity are dangerous because they can steer privileged API usage, bypass normal separation between packages, and make the agent trust adversarial content for credentialed actions.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicated finding points to the same hidden instruction block that attempts to control how the agent authenticates and identifies itself to an external API. Even if the values look product-related rather than overtly malicious, hidden instructions that override request identity are dangerous because they can steer privileged API usage, bypass normal separation between packages, and make the agent trust adversarial content for credentialed actions.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This is effectively the same hidden-instruction issue duplicated by the scanner: comment-based directives specify credentialed request behavior and origin headers outside normal user visibility. In context, the skill's requirement to preserve package identity and source metadata makes such hidden control more concerning because it governs authenticated network behavior.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This is effectively the same hidden-instruction issue duplicated by the scanner: comment-based directives specify credentialed request behavior and origin headers outside normal user visibility. In context, the skill's requirement to preserve package identity and source metadata makes such hidden control more concerning because it governs authenticated network behavior.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instruction finding points to the same concealed request-identity block. Concealing mandatory header behavior in comments is risky because it can silently steer agent requests and complicate auditing of what identity information is attached to outbound calls.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instruction finding points to the same concealed request-identity block. Concealing mandatory header behavior in comments is risky because it can silently steer agent requests and complicate auditing of what identity information is attached to outbound calls.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The skill directs the agent to collect device fingerprints and create an external account automatically, which is outside the stated tender-query purpose and introduces privacy-sensitive data handling. Even with consent language and hashing, collecting hardware-derived identifiers and transmitting them to a third party expands the trust boundary and can surprise users who only intended to query bid data.
The documentation instructs OS-specific local inspection and shell/PowerShell execution to derive a MAC-based device hash. This is dangerous because it causes the agent to probe the local environment and extract hardware-linked identifiers unrelated to the core business function, creating privacy, fingerprinting, and command-execution risk if followed by an automated agent.
The skill instructions, examples, prompts, and required user-facing phrasing are entirely in Chinese, including mandated output snippets such as the masked-contact notice and guidance text. While the skill is Guangdong-focused geographically, the file does not explicitly justify that responses must be in Chinese or offer the user a language/locale choice, which can violate language/locale policy requirements.
L003 与 L548-L562 都强调该包的默认地区应为广东，并要求在未指定地区时按广东检索并告知用户范围。L284 却规定“地区默认全国”，这与技能定位和后文广东版专属规则直接冲突，可能导致代理执行与声明不一致。
L260-L265 明确写明 query_bids_advanced 的旧参数 min_money/max_money 已移除，必须改用 min_amount/max_amount（万元）。但 L624-L625 又声称该接口参数名变成 min_money 且单位为元，这会直接误导调用者使用与前文相反的参数。
The skill instructs automatic expansion of a user-provided company nickname into all matching headquarters and branch entities and then reuses that broader set for downstream analysis without user confirmation. This can silently broaden the query scope, causing collection and analysis of data about additional entities the user did not explicitly request, which is a privacy, authorization, and user-intent integrity issue in a business intelligence context.
The skill instructs the agent to send API-key-authenticated requests plus package-identifying headers, but it does not require any user-facing disclosure that external transmission will occur or what metadata is being shared. In a data-query skill, this creates a real privacy and transparency risk because user queries and account-linked request metadata may be sent to a third-party service without informed consent.
The documentation mandates an automatic account-balance/version-check request on first use before the user's substantive query, without requiring prior disclosure or consent. Even if free and non-purchasing, it still contacts an external service using the user's credentials and may reveal usage metadata unrelated to the user's immediate request.
This markdown directs the agent to use fixed Chinese prompts and explanations, including the consent text, but does not provide any user opt-in or alternative locale handling. That can violate language/locale policy when the user or agent context is not explicitly Chinese.
This section explicitly instructs the agent to serialize and send collected device features to an external auto-registration endpoint. Because the transmitted data includes a persistent device-derived identifier and triggers account creation with a third party, it represents external data exfiltration beyond the core tender-query function.
> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>
The curl example reinforces and operationalizes external transmission of collected local data to a third-party service. Even though the text discusses safe JSON serialization, the substantive issue is that the skill is instructing outbound transfer of device-linked metadata unrelated to the manifest's search/analysis scope.
> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>
> 历史教训：曾有版本采集 `home_path`，Windows 的 `C:\Users\alice` 直接拼进 JSON 字符串时
No suspicious patterns detected.