标讯 · 浙江招标中标与招投标数据查询

• Outcome: Review
• Latest audit: Oct 14, 2026 · 11:13 PM UTC
• Version: 1.0.5

Overview

The skill mostly matches its procurement-search purpose, but it includes under-disclosed account and update-check behavior using the user’s API credential.

Review this before installing if you are uncomfortable with credentialed account checks or local secret storage. The skill may use an existing API key, create a trial account after consent using limited device characteristics, write the API key to ~/.zlbx/config.json, send package/source headers, and perform an automatic balance/update notice check with a display acknowledgement.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (32)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 89% confidence

Finding

This duplicate finding points to the same hidden instruction block, which embeds mandatory request headers and update-ack workflow logic inside an HTML comment. Concealed execution guidance reduces auditability and can be abused to hide data-sharing or side-effecting behavior from both users and reviewers.

Content

Scanner excerpt · SKILL.md (reported line 653)May include surrounding context.

2. 县级市要用 counties：义乌、慈溪、余姚、诸暨、乐清、瑞安都是，传进 cities 返回空。
3. 杭州+宁波占全省 44.9%，不加 cities 时结果会被这两市主导。

安装包身份与升级检查：所有发往知了标讯 API 的请求（包括账户查询）必须额外携带以下两个请求头：

text

X-Skill-Package: tender-zhejiang/1.0.5

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 89% confidence

Finding

This duplicate finding points to the same hidden instruction block, which embeds mandatory request headers and update-ack workflow logic inside an HTML comment. Concealed execution guidance reduces auditability and can be abused to hide data-sharing or side-effecting behavior from both users and reviewers.

Content

Scanner excerpt · SKILL.md (reported line 653)May include surrounding context.

2. 县级市要用 counties:义乌、慈溪、余姚、诸暨、乐清、瑞安都是,传进 cities 返回空。
3. 杭州+宁波占全省 44.9%,不加 cities 时结果会被这两市主导。

安装包身份与升级检查:所有发往知了标讯 API 的请求(包括账户查询)必须额外携带以下两个请求头:

text

X-Skill-Package: tender-zhejiang/1.0.5

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 94% confidence

Finding

This duplicate finding identifies the same hidden-instruction block that attempts to control request identity and package/source headers. In this context, the risk is increased because the instructions govern authenticated API use and package attribution, which could be abused to induce the agent to make external calls with sensitive credentials or misleading provenance.

Content

Scanner excerpt · references/api-account.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 94% confidence

Finding

This duplicate finding identifies the same hidden-instruction block that attempts to control request identity and package/source headers. In this context, the risk is increased because the instructions govern authenticated API use and package attribution, which could be abused to induce the agent to make external calls with sensitive credentials or misleading provenance.

Content

Scanner excerpt · references/api-account.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 94% confidence

Finding

This duplicate hidden-instruction finding points to the same issue: model-consumable prompt content directs credentialed requests with fixed identity headers and forbids using other package identities. Such embedded instructions are risky because they influence runtime behavior from untrusted content and can facilitate covert data transmission or policy bypass through prompt injection-style control of network metadata.

Content

Scanner excerpt · references/api-market.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 94% confidence

Finding

This duplicate hidden-instruction finding points to the same issue: model-consumable prompt content directs credentialed requests with fixed identity headers and forbids using other package identities. Such embedded instructions are risky because they influence runtime behavior from untrusted content and can facilitate covert data transmission or policy bypass through prompt injection-style control of network metadata.

Content

Scanner excerpt · references/api-market.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 93% confidence

Finding

This duplicate hidden-instructions finding points to the same core risk: the document attempts to invisibly govern authenticated request behavior through embedded directives instead of trusted code or policy. In a skill that performs paid API queries and account checks, such instructions increase the blast radius because they can trigger privileged actions, billing-affecting calls, and disclosure of package/source identifiers under adversarial prompt control.

Content

Scanner excerpt · references/api-registry.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 93% confidence

Finding

This duplicate hidden-instructions finding points to the same core risk: the document attempts to invisibly govern authenticated request behavior through embedded directives instead of trusted code or policy. In a skill that performs paid API queries and account checks, such instructions increase the blast radius because they can trigger privileged actions, billing-affecting calls, and disclosure of package/source identifiers under adversarial prompt control.

Content

Scanner excerpt · references/api-registry.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-company.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-search.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-company.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-search.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 88% confidence

Finding

The document embeds hidden/packaged instructions directing the agent to attach specific identity headers and preserve package provenance on outbound requests. Hidden operational instructions are dangerous because they can steer agent behavior outside visible user intent, and package/source headers can facilitate opaque tracking or request attribution the user did not knowingly approve.

Content

Scanner excerpt · references/auto-register.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 88% confidence

Finding

The document embeds hidden/packaged instructions directing the agent to attach specific identity headers and preserve package provenance on outbound requests. Hidden operational instructions are dangerous because they can steer agent behavior outside visible user intent, and package/source headers can facilitate opaque tracking or request attribution the user did not knowingly approve.

Content

Scanner excerpt · references/auto-register.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file is entirely written as mandatory operating guidance in Chinese and presents user-facing reply templates in Chinese, but it does not state that language should follow the user's preference or provide opt-in for another locale. That creates a natural-language locale policy risk because the skill appears to enforce a specific language by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill directs the agent to automatically register for an API key and persist credentials to a local file when existing credentials are absent. Even though it requires consent before registration, the top-level description does not clearly disclose this device-fingerprint collection and local secret storage behavior up front, which creates a meaningful privacy and credential-handling risk in a skill context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest description at L003 says this edition uses Zhejiang Province as the default retrieval scope unless the user specifies otherwise. However, the query execution rules at L284-L285 explicitly state '地区默认全国', which would cause behavior inconsistent with the package's claimed Zhejiang-focused defaulting.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The package-specific section at L548-L562 says this edition's default is Zhejiang and requires disclosing that default to the user. Earlier, L284-L285 says the default region is nationwide; these instructions cannot both be true, so the documented intent conflicts with itself and would drive divergent behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The instructions require that when skill_update_notice appears, the agent must relay the message to the user verbatim, and then confirm display only after sending that visible message. Because the file is entirely Chinese and provides no opt-in or alternative locale handling, this creates a user-facing language constraint without offering language choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs the agent to automatically expand a user-supplied company name into multiple related legal entities and run follow-up analysis without confirmation. This can silently broaden query scope beyond the user's intent, causing over-collection of company data, inaccurate attribution across affiliates, and unexpected consumption of paid API resources.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This API exposes project contact information, including phone numbers, and the skill guidance focuses on display mechanics rather than strong privacy safeguards or purpose limitation. Even with partial masking for some accounts, this creates a privacy and misuse risk because an agent could facilitate targeted outreach, harvesting, or profiling of identifiable individuals from procurement records.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest describes procurement/tender data query and analysis functions, but these lines add a separate workflow for checking package upgrade notices and posting display acknowledgements back to the service. That client-notification/telemetry-style capability is not justified by the user-facing business purpose described in the manifest.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation instructs the agent to make automatic network requests to the account balance endpoint and then send an acknowledgment callback, even before the user has explicitly asked for those actions. This creates hidden side effects, transmits credentials and package-identifying headers to a third party, and can expose account metadata or trigger non-obvious external interactions without informed user consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

L105 says to relay the skill_update_notice.message to the user verbatim, and the surrounding file is entirely Chinese with no indication that language choice depends on user preference. This creates a natural-language policy concern because user-facing content may be forced into a specific language without opt-in or fallback.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file’s operational instructions and user-facing guidance are entirely written in Chinese, including mandatory relay behavior such as forwarding skill_update_notice messages verbatim. There is no indication that the user may choose another language or that the Chinese-only requirement is regionally mandated, which creates a language-policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.