标讯 · IT信息化招标中标与招投标数据查询

• Outcome: Review
• Latest audit: Oct 14, 2026 · 11:21 PM UTC
• Version: 1.0.5

Overview

This appears to be a legitimate tender-data skill, but it hides credentialed request and acknowledgement instructions in markdown comments and can collect a device fingerprint and store an API key locally.

Review this skill before installing if you are uncomfortable with device-linked trial registration, local API-key storage, or hidden markdown-comment instructions controlling authenticated requests. Prefer supplying your own ZLBX_API_KEY if you do not want automatic registration, and remove ~/.zlbx/config.json if you later want to revoke the locally stored credential.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (29)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 91% confidence

Finding

This duplicate finding points to the same hidden-instructions block embedded in an HTML comment. Even if the content appears administrative, concealing request-shaping and remote acknowledgment behavior in hidden text is a prompt-transparency issue that can materially affect how the agent interacts with external services.

Content

Scanner excerpt · SKILL.md (reported line 661)May include surrounding context.

拿几个宽词冒充全量会漏掉标题里不写这些词的公告。本节的关键词矩阵是用来聚焦方向的， 不是用来模拟"全部"的。

安装包身份与升级检查：所有发往知了标讯 API 的请求（包括账户查询）必须额外携带以下两个请求头：

text

X-Skill-Package: tender-it/1.0.5

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 91% confidence

Finding

This duplicate finding points to the same hidden-instructions block embedded in an HTML comment. Even if the content appears administrative, concealing request-shaping and remote acknowledgment behavior in hidden text is a prompt-transparency issue that can materially affect how the agent interacts with external services.

Content

Scanner excerpt · SKILL.md (reported line 661)May include surrounding context.

拿几个宽词冒充全量会漏掉标题里不写这些词的公告。本节的关键词矩阵是用来聚焦方向的, 不是用来模拟"全部"的。

安装包身份与升级检查:所有发往知了标讯 API 的请求(包括账户查询)必须额外携带以下两个请求头:

text

X-Skill-Package: tender-it/1.0.5

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 89% confidence

Finding

This duplicate finding points to the same hidden instruction block that tells the agent to use configured credentials and preserve package/source headers. Such hidden control text is a true vulnerability pattern because it can cause an LLM-driven agent to exfiltrate or misuse secrets in authenticated requests if the surrounding trust model is weak, even when the stated business purpose is legitimate. The skill context makes it somewhat less suspicious than overtly malicious prompt injection, but still dangerous because it directly governs credentialed network behavior.

Content

Scanner excerpt · references/api-account.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 89% confidence

Finding

This duplicate finding points to the same hidden instruction block that tells the agent to use configured credentials and preserve package/source headers. Such hidden control text is a true vulnerability pattern because it can cause an LLM-driven agent to exfiltrate or misuse secrets in authenticated requests if the surrounding trust model is weak, even when the stated business purpose is legitimate. The skill context makes it somewhat less suspicious than overtly malicious prompt injection, but still dangerous because it directly governs credentialed network behavior.

Content

Scanner excerpt · references/api-account.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-company.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-market.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-registry.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-search.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-company.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-market.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-registry.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-search.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This duplicate finding points to the same hidden instruction block that directs the model to send fixed package/source headers. Such hidden prompt content can steer sensitive network behavior invisibly and is especially risky in a skill that also performs account registration and API-key handling.

Content

Scanner excerpt · references/auto-register.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This duplicate finding points to the same hidden instruction block that directs the model to send fixed package/source headers. Such hidden prompt content can steer sensitive network behavior invisibly and is especially risky in a skill that also performs account registration and API-key handling.

Content

Scanner excerpt · references/auto-register.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The instruction “按以下优先级，命中即停，不要做任何额外提示” appears inside entirely Chinese-facing guidance and the document provides no option for users to choose another language or locale. This creates a natural-language policy concern because the skill behavior is documented as Chinese-only by default rather than offering language choice or justified regional restriction.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to collect device characteristics (platform, arch, mac_hash), automatically register an external account, and persist the returned API key to a local config file. That exceeds the core tender-query function and creates privacy and credential-handling risk, especially because the flow can bootstrap third-party access and store secrets on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation describes automatic collection of device characteristics and writing API keys to a local config file, yet the skill description lacks a clear up-front safety/privacy warning. Users may not understand that hardware-derived identifiers and credentials will be transmitted to and stored for a third-party service, undermining informed consent and increasing privacy and credential exposure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation explicitly tells the agent to automatically select all semantically matched companies, including headquarters and subsidiaries, without user confirmation. In a procurement and company-analysis context, this can cause over-broad data retrieval, mistaken attribution, and unintended disclosure or processing of information about entities the user did not intend to query.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This section enables retrieval of project contact information, including phone numbers, with only a minimal note about masking for some account tiers and no prominent privacy, purpose-limitation, or anti-harvesting warning. In practice, this increases the risk of privacy misuse, contact scraping, and social-engineering abuse, especially because the skill is designed for business intelligence and supplier discovery workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Line L068 mandates a fixed external wording style in Chinese for all outward-facing responses, including dialogue and reports, with no indication that the user can choose another language. This is a natural-language locale constraint that applies broadly to user-visible output and is not documented as an explicitly region-limited or opt-in behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file instructs the agent to relay update notices to the user exactly as returned (原样转达用户) and to send the reminder into the visible conversation, while the surrounding documentation is explicitly Chinese. This creates a language/locale constraint for user-facing output without stating that the user can choose another language or opt in to Chinese responses.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown repeatedly prescribes exact user-facing copy in Chinese, such as the consent prompt and later status messages, but does not offer any user language preference or opt-in. This creates a locale/language policy issue because the skill mandates a specific language for user interactions regardless of user context.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This skill instructs the agent to transmit locally collected device fingerprints to an external registration endpoint. Even though the document minimizes collection and hashes the MAC address, it still enables outbound transfer of persistent device-linked identifiers and an API-key provisioning workflow, which is sensitive and can be abused or unexpectedly trigger privacy-impacting registration flows.

Content

Scanner excerpt · references/auto-register.md (reported line 130)May include surrounding context.

md

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/auto-register.md (reported line 131)May include surrounding context.

md

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>
> 历史教训：曾有版本采集 `home_path`，Windows 的 `C:\Users\alice` 直接拼进 JSON 字符串时

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

This duplicate finding refers to the same persistence behavior: creating ~/.zlbx, merging config, writing source: auto, and continuing with the stored X-API-Key. In context, this is more dangerous because the secret is not merely reused in-memory; it is intentionally made durable for future sessions, creating a lasting authentication artifact on the endpoint.

Content

Scanner excerpt · references/auto-register.md (reported line 195)May include surrounding context.

text

注意事项：
- 目录不存在时先 `mkdir -p ~/.zlbx`
- 文件已存在时**合并而非覆盖**（保留用户可能的其他配置）
- `source: "auto"` 字段必须写入，**这是后续判断「是否输出自动登录链接」的关键依据**

Static analysis

No suspicious patterns detected.