Security audit
Security checks for vulnerabilities and agentic risk
This looks like a real sales-lead tool, but it needs review because it can register accounts using a hashed device identifier, store an API key locally, and place login-bypass links into shareable reports.
Install only if you are comfortable with this skill using the 知了标讯 service, spending API credits, creating or reusing a local API key, and collecting a hashed device identifier for trial registration after consent. Treat generated reports and links as potentially access-bearing because they may include signed sk parameters.
The activation logic is intentionally broad: it says the skill must be used even when the user did not mention leads, for common requests like finding customers, developing markets, or who might buy a product. This can cause over-triggering, unnecessary external data sharing, and unintended paid API usage for loosely related sales conversations.
Referenced artifact was not completely inspected
完整模式下，对话清单输出后默认再用 `scripts/render_report.py` 生成一份可分享的 HTML 版商机清单并告知保存路径（详见 report-template.md「HTML 报告导出」）。
Referenced artifact was not completely inspected
完整模式下，对话清单输出后默认再用 `scripts/render_report.py` 生成一份可分享的 HTML 版商机清单并告知保存路径（详见 report-template.md「HTML 报告导出」）。
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
安装包身份与升级检查：所有发往知了标讯 API 的请求（包括账户查询）必须额外携带以下两个请求头：
X-Skill-Package: ai-sales-lead-radar/1.0.8
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
安装包身份与升级检查:所有发往知了标讯 API 的请求(包括账户查询)必须额外携带以下两个请求头:
X-Skill-Package: ai-sales-lead-radar/1.0.8
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: opportunity-radar/1.0.3
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: opportunity-radar/1.0.3
This duplicate hidden-instructions finding refers to the same concealed request-identity directive at the top of the file. Concealed agent instructions reduce transparency and make it easier to embed behavior that bypasses normal purpose and consent expectations.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: opportunity-radar/1.0.3
This duplicate hidden-instructions finding refers to the same concealed request-identity directive at the top of the file. Concealed agent instructions reduce transparency and make it easier to embed behavior that bypasses normal purpose and consent expectations.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: opportunity-radar/1.0.3
The document embeds a full account lifecycle flow—automatic account creation, API key issuance, persistence, recharge handling, and upgrade acknowledgements—despite the skill being presented as a sales-lead discovery tool. This materially expands the skill’s authority and data handling beyond its stated purpose, creating an unnecessary credential-management capability that could be abused or surprise users.
The skill instructs the agent to fingerprint the device by collecting platform, CPU architecture, and a hashed MAC address using OS-specific shell/PowerShell commands. For a lead-generation skill, this collection is not necessary to fulfill the user task and introduces privacy risk, command-execution risk, and cross-session device tracking.
The hidden instruction block attempts to steer internal request identity behavior through commented prompt content rather than trusted code. Hidden operational instructions are risky because they can introduce covert side effects, evade normal user visibility, and interfere with secure tool mediation.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: opportunity-radar/1.0.3
The hidden instruction block attempts to steer internal request identity behavior through commented prompt content rather than trusted code. Hidden operational instructions are risky because they can introduce covert side effects, evade normal user visibility, and interfere with secure tool mediation.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: opportunity-radar/1.0.3
The template explicitly requires exposing API-returned URLs including sk login-bypass parameters unchanged to users. If those parameters confer authenticated or bearer-like access, they become secrets in generated content and can be copied, forwarded, stored, or embedded elsewhere, leading to unauthorized access and link-based credential leakage.
The instructions propagate the original access-bearing URLs into JSON and HTML artifacts and then direct the agent to disclose the resulting shareable file path. This compounds the risk by turning transient tokenized links into persistent files that are easier to redistribute, index, or recover from disk.
This duplicate finding reflects the same hidden-instruction block at the top of the file. Even if the author's goal is operational consistency rather than abuse, hidden instructions that alter authenticated request behavior remain a prompt-injection style risk because they are not transparent to users and can cause the agent to send sensitive or policy-relevant headers automatically.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: opportunity-radar/1.0.3
This duplicate finding reflects the same hidden-instruction block at the top of the file. Even if the author's goal is operational consistency rather than abuse, hidden instructions that alter authenticated request behavior remain a prompt-injection style risk because they are not transparent to users and can cause the agent to send sensitive or policy-relevant headers automatically.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: opportunity-radar/1.0.3
Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
ROUTE_COLOR = {"拟建": "#7c5cbf", "意向": "#0b7a6a", "临期": "#b9770e"}
# 知了标讯白色 logo（299x96 PNG base64 内嵌，保证报告离线/打印/转发时不裂图）
_LOGO_B64 = "iVBORw0KGgoAAAANSUhEUgAAASsAAABgCAYAAABFTFSvAAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAABK6ADAAQAAAABAAAAYAAAAACurZhBAAA2V0lEQVR4Ae2dB5xU1fXHzzZ6752ldxHpHTtqTKJJjEmMGkvKP/aIRk0UayzYxZJouokaYyzRiKCAoIB0kN47LB0WFnZh9//9vZmHb4eZnZndmWVW3vl8fjOv3fvuO+++3z3nvHvvM/PF14CvAV8DFUADafbM2OusKOMCKywoqgDlDV/ENIpemJ5vGYW5VmjbrChtlaXZYks7usRuumlb+ET+Vl8DvgYqkgYyzdJ6WqWskXa0IhU7UlnTzLgiK4K8jh7litK22FPPT4O03rb8zAk26hc5kVL6230N+BpIbQ1kWpEdsYJ8Hu4jqV3SeEuXlpZBkhaWmf49s/RvW9aRFfbs2D9ZweF/2i23bIo3O/94XwO+Bk6sBtJP7OmTeHZZV0JBgdmRI1mWnt7V0jIesozK7+H6/shGj66UxLP7Wfsa8DWQYA18fcnKq6iAWxggrbS0XpDWc1a34dP2zDMtvIf5y74GfA2krgZODrJy9e+SVuHROpae8ROC8i/bsy/1cHf7/74GfA2krgZOLrJy70NhoWJ0lXENz8Tces6eHHuqu8v/9zXgayA1NXBykpXuhayswkJeMKQPtHR7greGnVLzFvml8jXga0AaOHnJSlfvENbRLEtLG2BphaPtiSfqabMvvgZ8DaSeBk5ustL9EGEVFVW1jIwzLC3rlyzTWcsXXwO+BlJNAz5Z6Y4ohnXkaCPLSP++PfnCkFS7SX55fA34GjjZ3cDjakBatqUduQZ3sOpxu/wNvgZ8DZxQDfiWlav+gDtY3TKz+plVHupu9v99DfgaSA0N+GTlvQ8Bwmpm6YUX2htvaLiOL74GfA2kiAaST1bEr5Miycq3sLAm5e1jG7e3SUq5/Ux9DfgaKJUGkkNWRxgUfUSTHjAJQjqnKGRZ6wpklyQByybyEZpIQeC4jHQy1/HKV9sSIcovLS0NV7ARhcUd9MXXgK+BVNGAJlRJnEBGVbOy7Lz2be1bbdtax3p1LYtnf1tenk3euMneWrHSVu7cbTCNSAGyUU9yCILV9IxMq5KVaUfZdPioBh9DQDomTXxaZNUyM613s2Z2UYe2dlrDhlaD8+w5nG8zt22zd1atthlbmcZKZChyLKsUFtWxtKJTyOYfZc3KT+9rwNdAYjSQZk8//wKk8POyThGTAfF0b9DQHh022M5p3eq40slr27R/vz06a649N28uYSGzVnXr2vltWtvpLVpY29q1rHqlLDsC4ew8dMjm5+yw91avsbk5260mxHRr3952eZdOVp3lUNHxf1m01B6bNdu25uZChmUINzkEmXYIa+1dGPNKppPJCz2fv+5rwNdA+WsgIZZVBpbPKQ0b2avnn2tdsKaO4E6t3L3bpm/ZagcKjjgW1sAmTaxFzZr20JCB1q1BPQwXw0pqZw2rhu8lMBQr6mendLecgwctl2leOkFsynfdvn32xdYcZ3vzmjWsb+NG1rxGDefYJtWr2k2Tpth20pTJwioqghHTGllWVl1uiU9W5V8v/TP6GjhOAwkhq/pVqth9gwY4RLU3P98enTnHnsd62pN32IkrZeLi9Wve1P5w1unWtX59+1mP7scVJNyGLFw6EZGkEKKat32H3Txxkk1du94ho0xcQ+V3W7/e9oNOHe2c7NZ2Q699ds/n05nduJTCeZAM4m01sK4UbPfF14CvgRTQQJnJqjJhpcHNm9t5uHP
...[truncated 27 chars]
The skill performs local file writes by generating and saving HTML reports, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates a mismatch between documented behavior and granted capabilities, weakening least-privilege controls and making unintended file writes harder to govern or audit.
The skill content and prescribed user-facing phrases are entirely in Chinese, and the instructions do not offer an opt-in or alternative language path. Under the policy, forcing a specific language without user choice can be a natural-language policy violation unless clearly documented as region-specific or optional.
The documentation explicitly tells the agent to output url values containing an sk login-bypass parameter 'as-is' for direct clicking, without any user-facing warning or access-control guidance. If those URLs grant authenticated access or embed bearer-like tokens, exposing or propagating them can leak privileged access, enable unintended sharing, and bypass normal authentication expectations.
The file contains prescribed user-facing wording and instructions entirely in Chinese, including text to relay verbatim to the user, but does not indicate that the user may choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
This section explicitly instructs transmission of collected device features to an external service during auto-registration. Even though it recommends safe JSON serialization, the underlying behavior is still exfiltration of host-derived identifiers to a remote endpoint outside the core lead-discovery function.
> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>
The curl-based example provides another concrete path for transmitting locally collected device information to a remote registration endpoint. Including multiple transport mechanisms increases the likelihood that an agent or integrator executes the external transmission behavior in practice.
> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>
> 历史教训：曾有版本采集 `home_path`，Windows 的 `C:\Users\alice` 直接拼进 JSON 字符串时
The skill directs writing API credentials to ~/.zlbx/config.json and reusing them automatically in later requests. Persisting service credentials in a user home directory from within a sales-lead skill creates unnecessary secret-handling responsibilities and increases the blast radius if the host or profile is shared or compromised.
No suspicious patterns detected.