工商数据查询 · 企业基本信息、股东、分支、投资与变更

• Outcome: Pass
• Latest audit: Oct 13, 2026 · 8:02 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed company-registry lookup integration; it sends company queries to its vendor API and only performs auto-registration after user consent.

Install only if you are comfortable sending company lookup queries to zhiliaobiaoxun.com services. If you do not want automatic device-based registration, set ZLBX_API_KEY yourself or create ~/.zlbx/config.json manually before first use. Protect ~/.zlbx/config.json like a credential because it can contain an API key.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The skill instructs the agent to collect device fingerprints (platform, CPU architecture, and a hashed MAC address) and transmit them to an external registration endpoint. Even though the document claims privacy minimization and requires consent, this still constitutes exfiltration of host-derived identifiers to a third party and can uniquely track a device or correlate user activity. The surrounding skill context makes this more sensitive because the collection is performed automatically to obtain credentials for later API use.

Content

Scanner excerpt · references/auto-register.md (reported line 121)May include surrounding context.

md

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/auto-register.md (reported line 122)May include surrounding context.

md

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>
> 历史教训：曾有版本采集 `home_path`，Windows 的 `C:\Users\alice` 直接拼进 JSON 字符串时

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The skill persists a newly issued API key to ~/.zlbx/config.json and then immediately reuses it for subsequent requests. Persisting secrets in a predictable file path creates credential-at-rest risk: other local processes, users, backups, or misconfigured file permissions could expose the key, enabling unauthorized use of the associated account and any remaining quota. The context makes this more concerning because the credential is obtained automatically by the agent rather than explicitly supplied by the user.

Content

Scanner excerpt · references/auto-register.md (reported line 186)May include surrounding context.

text

注意事项：
- 目录不存在时先 `mkdir -p ~/.zlbx`
- 文件已存在时**合并而非覆盖**（保留用户可能的其他配置）
- `source: "auto"` 字段必须写入，**这是后续判断「是否输出自动登录链接」的关键依据**

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The skill persists a newly issued API key to ~/.zlbx/config.json and then immediately reuses it for subsequent requests. Persisting secrets in a predictable file path creates credential-at-rest risk: other local processes, users, backups, or misconfigured file permissions could expose the key, enabling unauthorized use of the associated account and any remaining quota. The context makes this more concerning because the credential is obtained automatically by the agent rather than explicitly supplied by the user.

Content

Scanner excerpt · references/auto-register.md (reported line 186)May include surrounding context.

text

注意事项:
- 目录不存在时先 `mkdir -p ~/.zlbx`
- 文件已存在时**合并而非覆盖**(保留用户可能的其他配置)
- `source: "auto"` 字段必须写入,**这是后续判断「是否输出自动登录链接」的关键依据**

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation instructs sending company identifiers and query terms to an external vendor API, but it does not pair that with a clear user-facing disclosure at the point of use that data will leave the platform and be processed by a third party. In this skill’s context, company names and identifiers may be sensitive business-query metadata, so the lack of explicit notice and consent can create privacy, compliance, and trust risks even if the data is not highly confidential.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.