客户背景调查-摸清客户采购底细

• Outcome: Review
• Latest audit: Aug 14, 2026 · 2:19 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed company-research assistant, but it also handles device fingerprinting, local credential persistence, and shareable login-bypass links in ways users should review before installing.

Install only if you are comfortable with this vendor receiving company queries and, during auto-registration, a hashed device identifier. Prefer configuring ZLBX_API_KEY yourself to avoid auto-registration, treat ~/.zlbx/config.json as sensitive, and avoid sharing generated reports or raw links because they may contain sk免登录 access parameters.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill explicitly states it will read from local configuration (`~/.zlbx/config.json`) and write reports to `~/zlbx-company-intel-files/`, but no corresponding permissions are declared. Undeclared file access weakens user and platform visibility into the skill's actual capabilities, creating a trust and containment gap if the skill is invoked in environments that rely on declared permissions for enforcement or review.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 79% confidence
• Finding: The skill is described as a background-check/reporting tool, but it also performs HTML report generation with embedded branding, promotional links, and export features. While not inherently malicious, this is a material behavior expansion beyond pure analysis and can surprise users or reviewers, especially because generated artifacts may contain third-party links and persistent content not clearly disclosed in the top-level description.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file defines a full auto-registration, device-identification, account persistence, and recharge flow inside a skill whose declared purpose is customer background investigation. That is a clear scope mismatch: it directs the agent to collect device-derived identifiers and create external accounts unrelated to the user-facing task, which increases privacy, compliance, and supply-chain risk. The built-in consent text reduces risk somewhat, but the functionality still exceeds least-privilege expectations for this skill.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: These sections instruct collection of platform, architecture, and a SHA256-hashed MAC-derived identifier for trial deduplication, then transmission to a remote service. Even though the raw MAC is not sent, the hash is still a stable device fingerprint that can be used to track a device across sessions, and it is unrelated to performing customer background checks. In this skill context, that makes the behavior more dangerous because users would not reasonably expect endpoint fingerprinting from a procurement-intelligence assistant.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The file directs the agent to write API keys into `~/.zlbx/config.json`, merge configs, and mark credential source metadata. Persisting credentials locally is outside the declared analysis purpose and creates local-secret exposure risk if file permissions, multi-user environments, backups, or other tools access the config. Because this is embedded in a business-research skill rather than a dedicated auth subsystem, the behavior is harder for users and reviewers to anticipate.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The balance-exhaustion flow generates login/recharge links and explicitly guides users into phone binding to obtain more quota. This is unrelated to background-check functionality and expands the skill into account monetization and identity-linking workflows, which can expose users to additional tracking and social-engineering-style prompts. In-context, this is suspicious because it blends a research tool with acquisition and account-binding behavior.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The template explicitly requires exposing API-returned URLs with raw `sk` login-bypass parameters in user-visible output. If those links are shared, logged, or copied into generated reports, anyone possessing them may gain unauthorized access to gated company and announcement pages, effectively leaking bearer-style access tokens.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: The template instructs the agent to generate an HTML report on disk and disclose its absolute filesystem path to the user. While not inherently a direct compromise, it leaks host filesystem structure and confirms file creation behavior, which can aid environment fingerprinting and unintentionally expose locally stored sensitive artifacts if paths are accessible or reused.

Vague Triggers

High

• Confidence: 91% confidence
• Finding: The skill repeatedly says it 'must' be used even when the user did not explicitly request a background check, broadening invocation beyond narrow user intent. Over-broad routing can cause unnecessary external data transfers, billing, report generation, and collection of company-related intelligence in situations where the user may have only wanted a simple query or general discussion.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly exposes project contact phone numbers and instructs the agent to display them exactly as returned, with no substantive privacy warning, purpose limitation, consent check, or anti-harvesting safeguard. In a customer background-check skill used for sales/BD preparation, this materially increases the risk of misuse of personal contact data for unsolicited outreach, profiling, or bulk collection.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill defaults to writing a report file to disk and returning the absolute path without informing the user beforehand or obtaining consent. This is risky because it performs a side effect outside the chat boundary, may persist potentially sensitive business intelligence locally, and exposes environment details that users did not explicitly request.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The template mandates preserving and sharing `sk` privileged-access parameters in generated links without any warning that the resulting report will contain access-bearing URLs. In a report designed for sharing, this greatly increases the chance of credential-like token leakage through recipients, screenshots, chat logs, or exported artifacts.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The instruction to expose full API-returned links containing `sk` parameters directly to users is a sensitive-data disclosure issue. These parameters function like access secrets or bearer tokens for gated resources, and embedding them in normal output or exported reports can leak privileged access beyond the intended recipient.

External Transmission

Medium

• Category: Data Exfiltration

Content

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>

• Confidence: 88% confidence
• Finding: requests.post(url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.