Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly coherent for a procurement-data assistant, but it embeds under-disclosed authenticated request behavior and tells the agent to preserve login-bypass signed URLs in shareable outputs.
Review before installing. This skill needs a ZLBX API key or consent-based auto-registration, may spend account credits, writes a local API-key config and HTML reports, and may place sk signed login-bypass links into chat/report files. Treat generated reports and links as sensitive and avoid forwarding them unless you are comfortable granting recipients access to the linked pages.
声明描述的是一个多功能招投标业务助手，强调查询、分析、决策和监控等完整业务能力；而提供的代码片段只是 company-intel 子模块中的 render_report.py，用于把已生成的企业情报 JSON 渲染成 HTML 报告，并提供打印/PDF/PNG 导出。它不包含任何检索外部数据、调用账户接口、执行投标决策分析、商机发现或标讯搜索的逻辑。虽然代码内容与“企业情报”这一子能力相关，但无法支撑“全能助手”这一整体声明，因此存在明显的描述与实际行为不匹配。
This is a duplicate hidden-instructions finding for the same commented block. Embedding mandatory request headers and acknowledgment logic inside a hidden section obscures real network behavior and weakens transparency controls, which can enable covert metadata transmission or unreviewed workflow changes.
安装包身份与升级检查：所有发往知了标讯 API 的请求（包括账户查询）必须额外携带以下两个请求头：
X-Skill-Package: zlbx-ai-platform/1.1.5
This is a duplicate hidden-instructions finding for the same commented block. Embedding mandatory request headers and acknowledgment logic inside a hidden section obscures real network behavior and weakens transparency controls, which can enable covert metadata transmission or unreviewed workflow changes.
安装包身份与升级检查:所有发往知了标讯 API 的请求(包括账户查询)必须额外携带以下两个请求头:
X-Skill-Package: zlbx-ai-platform/1.1.5
This duplicated hidden-instructions match is still a true issue: the skill relies on concealed model-consumable directives to shape authentication and source attribution headers. Such instructions are vulnerable to misuse, difficult for users to audit, and broaden the consequences of prompt/skill injection in the surrounding execution environment.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: ai-platform/1.0.1
This duplicated hidden-instructions match is still a true issue: the skill relies on concealed model-consumable directives to shape authentication and source attribution headers. Such instructions are vulnerable to misuse, difficult for users to audit, and broaden the consequences of prompt/skill injection in the surrounding execution environment.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: ai-platform/1.0.1
The template explicitly requires preserving and exposing full API-returned URLs containing the sk login-bypass signature, and to copy them into both the chat output and exported JSON/HTML. Distributing bearer-style signed links to end users and files materially increases the chance of unauthorized reuse, leakage through sharing or logs, and uncontrolled access outside the intended session.
This duplicate hidden-instruction finding is still a real issue: the content attempts to control authenticated request identity, package source, and version via embedded text that the model may obey. In a security-sensitive agent setting, hidden instructions that influence network calls are dangerous because they can cause unauthorized attribution, data access under existing credentials, or bypass of normal request mediation.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: ai-platform/1.0.1
This duplicate hidden-instruction finding is still a real issue: the content attempts to control authenticated request identity, package source, and version via embedded text that the model may obey. In a security-sensitive agent setting, hidden instructions that influence network calls are dangerous because they can cause unauthorized attribution, data access under existing credentials, or bypass of normal request mediation.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: ai-platform/1.0.1
This duplicate hidden-instruction finding points to the same issue: the markdown contains concealed directives that tell the agent to preserve and send specific identity headers with an API key. Even if the stated purpose is legitimate package identification, allowing skill text to invisibly control authenticated request metadata weakens separation between untrusted skill content and trusted execution policy, and could be abused in similar packages for credential misuse or request forgery.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: ai-platform/1.0.1
This duplicate hidden-instruction finding points to the same issue: the markdown contains concealed directives that tell the agent to preserve and send specific identity headers with an API key. Even if the stated purpose is legitimate package identification, allowing skill text to invisibly control authenticated request metadata weakens separation between untrusted skill content and trusted execution policy, and could be abused in similar packages for credential misuse or request forgery.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: ai-platform/1.0.1
This duplicate finding identifies the same hidden instruction block that tells the model how to authenticate and what package/source headers to send. Embedding such hidden control instructions in a markdown template creates a prompt-injection surface where untrusted content can influence outbound authenticated requests and leak or misuse tenant/package identity.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: ai-platform/1.0.1
This duplicate finding identifies the same hidden instruction block that tells the model how to authenticate and what package/source headers to send. Embedding such hidden control instructions in a markdown template creates a prompt-injection surface where untrusted content can influence outbound authenticated requests and leak or misuse tenant/package identity.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: ai-platform/1.0.1
This duplicate finding points to the same hidden instruction block that dictates credentialed request behavior. Even if the stated purpose is package identification, placing these directives in skill content creates an instruction-injection surface where untrusted markdown influences authenticated API traffic, which can lead to misuse of existing credentials and unreviewed side effects such as acknowledgement posts.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: ai-platform/1.0.1
This duplicate finding points to the same hidden instruction block that dictates credentialed request behavior. Even if the stated purpose is package identification, placing these directives in skill content creates an instruction-injection surface where untrusted markdown influences authenticated API traffic, which can lead to misuse of existing credentials and unreviewed side effects such as acknowledgement posts.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: ai-platform/1.0.1
The template mandates preserving full URLs with sk access parameters while also encouraging shareable HTML output, yet gives no warning that these links may embed reusable access tokens. This materially increases the chance of credential-like token leakage through conversations, files, screenshots, browser history, logs, and downstream sharing.
This duplicate finding identifies the same hidden-instruction pattern: concealed directives in comments telling the agent which headers and package identity to send. Such hidden control text reduces transparency and increases the risk of prompt injection-style behavior or undisclosed network actions.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: ai-platform/1.0.1
This duplicate finding identifies the same hidden-instruction pattern: concealed directives in comments telling the agent which headers and package identity to send. Such hidden control text reduces transparency and increases the risk of prompt injection-style behavior or undisclosed network actions.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: ai-platform/1.0.1
The workflow explicitly instructs the agent to output direct links containing embedded sk login-bypass parameters and says they can be clicked directly. Exposing bearer-style access tokens in user-visible URLs risks credential leakage through chat logs, browser history, referrers, screenshots, and link forwarding, potentially granting unauthorized access to protected resources.
This is the same hidden-instruction pattern: comment-embedded directives tell the agent which authenticated headers to send and forbid alternate sources/versions. Even if intended for package integrity, placing such instructions in model-consumable content makes them prompt-injection sensitive and can lead to unauthorized or opaque request behavior.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: ai-platform/1.0.1
This is the same hidden-instruction pattern: comment-embedded directives tell the agent which authenticated headers to send and forbid alternate sources/versions. Even if intended for package integrity, placing such instructions in model-consumable content makes them prompt-injection sensitive and can lead to unauthorized or opaque request behavior.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: ai-platform/1.0.1
This duplicate finding points to the same hidden instruction block that prescribes non-user-driven request headers and package provenance values. Even if intended for compatibility, embedding such directives in skill content creates a prompt-injection surface where the model may prioritize concealed package instructions over transparent, least-privilege request handling.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: ai-platform/1.0.1
This duplicate finding points to the same hidden instruction block that prescribes non-user-driven request headers and package provenance values. Even if intended for compatibility, embedding such directives in skill content creates a prompt-injection surface where the model may prioritize concealed package instructions over transparent, least-privilege request handling.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: ai-platform/1.0.1
This duplicate finding points to the same hidden-instruction pattern: the document attempts to control request identity and credential usage from within skill content. Even if the values appear legitimate, allowing the skill text to influence authenticated request composition creates an instruction-injection channel that can be abused in future revisions to redirect provenance, leak package metadata, or manipulate downstream trust decisions.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: ai-platform/1.0.1
This duplicate finding points to the same hidden-instruction pattern: the document attempts to control request identity and credential usage from within skill content. Even if the values appear legitimate, allowing the skill text to influence authenticated request composition creates an instruction-injection channel that can be abused in future revisions to redirect provenance, leak package metadata, or manipulate downstream trust decisions.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: ai-platform/1.0.1
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: ai-platform/1.0.1
No suspicious patterns detected.