ClawHub
Back to skill

Security audit

标讯 · 医疗卫生招标中标与招投标数据查询

Security checks for vulnerabilities and agentic risk

Overview

The procurement features fit their purpose, but optional trial registration understates the privacy implications of sending a lasting device identifier.

Review the device-identification privacy claim before accepting automatic registration. Configure a manually obtained API key to bypass device collection. Company names and search filters go to Zhiliaobiaoxun, and paid queries consume account credits. Protect the saved key and automatic-login links. The artifacts do not establish the provider's fingerprint retention or deletion practices.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared purpose concerns procurement data retrieval and analysis, not local device identification. This code accesses local hardware metadata and derives an identifier, without any demonstrated connection to the declared functionality. Although the filename suggests automatic registration, that purpose is not established by the snippet. The snippet does not transmit the resulting hash or modify system state.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

Local hardware identification is not described by the procurement-analysis purpose, and the supplied chunk establishes no connection to a necessary supporting function. The filename suggests automatic registration, but that capability is also undeclared. The code does not itself transmit the identifier or query procurement data.

Content

No source excerpt is available for this finding.

The automatic company-analysis workflow sends user-provided company names to an external API without a user-facing privacy disclosure.

Medium
Category
Output Handling
Confidence
88% confidence
Finding

This is an instruction to execute searches and follow-up queries, not merely an API catalog entry. It directs the agent to transmit the user's company selection to the external service without explaining to the user that their search terms will leave the conversation; those selections can reveal confidential research or procurement interests.

Content

No source excerpt is available for this finding.

The skill collects and transmits a persistent hardware fingerprint for trial-account registration, beyond its stated procurement-query purpose.

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The registration flow sends a deterministic, unsalted MAC-derived identifier while describing the collected features as having no identifying meaning and collecting no personal information. Hashing does not make a stable hardware identifier anonymous: it permits linkage across registrations and candidate-MAC matching, so the consent language understates the privacy exposure despite the explicit opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/auto-register.md (reported line 130)May include surrounding context.

md
> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/auto-register.md (reported line 131)May include surrounding context.

md
> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>
> 历史教训：曾有版本采集 `home_path`，Windows 的 `C:\Users\alice` 直接拼进 JSON 字符串时

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/auto-register.md (reported line 195)May include surrounding context.

text

注意事项：
- 目录不存在时先 `mkdir -p ~/.zlbx`
- 文件已存在时**合并而非覆盖**（保留用户可能的其他配置）
- `source: "auto"` 字段必须写入，**这是后续判断「是否输出自动登录链接」的关键依据**