标讯 · 江苏招标中标与招投标数据查询

• Outcome: Review
• Latest audit: Oct 14, 2026 · 11:19 PM UTC
• Version: 1.0.5

Overview

The skill is mostly a procurement-data API helper, but it also manages account creation, local API-key persistence, device fingerprinting, and hidden upgrade-check callbacks that deserve manual review before installation.

Install only if you are comfortable with this skill sending procurement queries to Zhiliaobiaoxun, using or creating an API key, storing that key in ~/.zlbx/config.json after consent, and performing package/version acknowledgement calls. Prefer preconfiguring ZLBX_API_KEY yourself if you do not want device-based auto-registration.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (31)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill directs the agent to collect device fingerprint attributes, automatically register an external account, and persist the returned API key to a local config file. That exceeds the stated data-query purpose and creates a credential-handling and privacy risk: the agent may exfiltrate host-identifying data to a third party and modify the local filesystem without a narrowly scoped, platform-mediated consent flow.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This duplicate hidden-instructions finding is valid for the same reason: the comment block contains behavioral directives affecting API calls and follow-up acknowledgments. Concealing operational logic in comments reduces transparency and can be abused to smuggle tracking, telemetry, or side-effecting behaviors past ordinary reviewers.

Content

Scanner excerpt · SKILL.md (reported line 660)May include surrounding context.

2. 区/县/县级市要用 counties：工业园区、江阴市、昆山市都属这一层，传进 cities 返回空。
3. 江苏中标公告多于招标公告（221.5 万 vs 169.4 万），找可投项目要明确传 "bid_type": "招标"。

安装包身份与升级检查：所有发往知了标讯 API 的请求（包括账户查询）必须额外携带以下两个请求头：

text

X-Skill-Package: tender-jiangsu/1.0.5

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This duplicate hidden-instructions finding is valid for the same reason: the comment block contains behavioral directives affecting API calls and follow-up acknowledgments. Concealing operational logic in comments reduces transparency and can be abused to smuggle tracking, telemetry, or side-effecting behaviors past ordinary reviewers.

Content

Scanner excerpt · SKILL.md (reported line 660)May include surrounding context.

2. 区/县/县级市要用 counties:工业园区、江阴市、昆山市都属这一层,传进 cities 返回空。
3. 江苏中标公告多于招标公告(221.5 万 vs 169.4 万),找可投项目要明确传 "bid_type": "招标"。

安装包身份与升级检查:所有发往知了标讯 API 的请求(包括账户查询)必须额外携带以下两个请求头:

text

X-Skill-Package: tender-jiangsu/1.0.5

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-account.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-company.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-account.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-company.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 85% confidence

Finding

This duplicate hidden-instruction finding is still a real issue because the markdown embeds agent-directing request identity requirements inside HTML comments at the top of the file. In an adversarial setting, concealed instructions weaken transparency and can be repurposed to smuggle more harmful directives, especially when they control authentication and outbound request metadata.

Content

Scanner excerpt · references/api-market.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 85% confidence

Finding

This duplicate hidden-instruction finding is still a real issue because the markdown embeds agent-directing request identity requirements inside HTML comments at the top of the file. In an adversarial setting, concealed instructions weaken transparency and can be repurposed to smuggle more harmful directives, especially when they control authentication and outbound request metadata.

Content

Scanner excerpt · references/api-market.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 89% confidence

Finding

This repeated hidden-instruction block tells the agent not to reuse other package versions or sources and to send specific identity headers. In an adversarial skill context, such directives can cause cross-package request confusion, unauthorized attribution, or unintended use of configured credentials under attacker-chosen metadata, especially since the content also mandates behavior around balance checks and acknowledgment callbacks.

Content

Scanner excerpt · references/api-registry.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 89% confidence

Finding

This repeated hidden-instruction block tells the agent not to reuse other package versions or sources and to send specific identity headers. In an adversarial skill context, such directives can cause cross-package request confusion, unauthorized attribution, or unintended use of configured credentials under attacker-chosen metadata, especially since the content also mandates behavior around balance checks and acknowledgment callbacks.

Content

Scanner excerpt · references/api-registry.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 92% confidence

Finding

This duplicate hidden-instruction finding points to the same concealed request-identity block that directs credential and header handling. Even if intended for routing or package attribution, embedding such instructions in hidden content increases the chance of covert behavior and weakens reviewability.

Content

Scanner excerpt · references/api-search.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 92% confidence

Finding

This duplicate hidden-instruction finding points to the same concealed request-identity block that directs credential and header handling. Even if intended for routing or package attribution, embedding such instructions in hidden content increases the chance of covert behavior and weakens reviewability.

Content

Scanner excerpt · references/api-search.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The amount-unit guidance is internally contradictory: earlier sections say query_bids_advanced uses the same min_amount/max_amount semantics as search_bids, while the later note claims query_bids_advanced and related tools use yuan. In security-sensitive procurement workflows, inconsistent units can silently widen or narrow filters by 10,000x, causing materially incorrect results, missed opportunities, or misleading analyses.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 89% confidence

Finding

The hidden comment block contains operational instructions for request identity headers that are not part of the visible user-facing purpose of the skill. Hidden control instructions can steer the agent to impersonate a package identity, bypass normal transparency expectations, and make security review harder because critical behavior is embedded in comments rather than explicit interface declarations.

Content

Scanner excerpt · references/auto-register.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 89% confidence

Finding

The hidden comment block contains operational instructions for request identity headers that are not part of the visible user-facing purpose of the skill. Hidden control instructions can steer the agent to impersonate a package identity, bypass normal transparency expectations, and make security review harder because critical behavior is embedded in comments rather than explicit interface declarations.

Content

Scanner excerpt · references/auto-register.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The manifest explicitly says '本版把 江苏省 作为默认检索范围', while the operational guidance later says '地区默认全国'. These are materially different default behaviors that would change what data is searched when the user does not specify a region.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill content is entirely written as mandatory operating instructions in Chinese and repeatedly specifies exact user-facing phrasing in Chinese, such as required disclosures and guidance text. There is no indication that the assistant should adapt to the user's preferred language or offer a language choice, which can violate language/locale policy for non-Chinese users.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The section at L284 states '地区默认全国', but the Jiangsu-specific section at L548-L557 states that when only this package is installed and the user did not specify a region, the default should be Jiangsu. These instructions conflict about what the skill should do in the same scenario.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to automatically expand a user's company query to multiple related entities and proceed with follow-on analysis without confirmation. This can cause over-collection and processing of data about unintended companies, producing inaccurate results, privacy overreach, or unnecessary paid API consumption when a shorthand name is ambiguous.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to automatically send a configured API key plus package identity headers to an external service, but it does not include any user-facing notice about credential use, data transmission, or what query contents may be disclosed. In a skill that handles business-intelligence and procurement queries, user-supplied search terms may contain sensitive commercial interests, so silent transmission increases privacy and governance risk even if the destination API is legitimate.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file is written entirely in Chinese and includes mandated user-facing behavior such as relaying update notices verbatim, but nowhere offers a language or locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file instructs the skill to make an account-balance/version-check call and process upgrade notices before normal task execution, which expands behavior beyond the user-requested bidding search/analysis function. This creates unnecessary metadata disclosure and outbound actions using the configured API credential, increasing privacy and scope-creep risk even if the endpoint is owned by the same service.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The package-update acknowledgement workflow directs the agent to send a follow-up reporting/receipt action after displaying a notice, which is unrelated to the advertised domain function of tender data analysis. That adds hidden stateful behavior and telemetry-like reporting under the user's credential context without a direct user request.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill embeds a full automatic account-registration, login enablement, and quota-top-up workflow that goes beyond the advertised bid-query/analysis scope. This expands the skill's authority into credential lifecycle management and remote account provisioning, increasing privacy, consent, and abuse risk if invoked by an agent without careful gating.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.