启信宝企业背调-招投标视角查企业

• Outcome: Review
• Latest audit: Aug 14, 2026 · 2:19 AM UTC
• Version: 1.0.1

Overview

This skill performs company-background checks as advertised, but it should be reviewed carefully because it stores credentials, fingerprints the device for trial signup, and deliberately includes login-bypass links in shareable reports.

Install only if you are comfortable sending company queries to the Zhiliaobiaoxun service, allowing consent-based trial registration to use a hashed device identifier, and storing generated reports plus signed platform links locally. Treat generated HTML reports and sk links as sensitive and avoid forwarding them outside the intended audience.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 79% confidence
• Finding: The skill explicitly states it will read a local config file (`~/.zlbx/config.json`) and write reports to a local directory (`~/zlbx-company-intel-files/`), yet the metadata declares only environment-variable requirements and no corresponding file permissions. This creates a least-privilege and transparency gap: a host may allow the skill to access local files without the user or policy engine clearly seeing that capability, increasing the risk of unintended local data exposure or unauthorized file writes.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file embeds an auto-registration workflow, device fingerprint collection, and local API-key persistence inside a company background-check skill, which exceeds the stated business purpose and materially broadens data collection and account-management behavior. Even though it describes limited fields and asks for consent, it still instructs the agent to collect hardware/network-derived identifiers and transmit them to an external service, creating privacy, compliance, and abuse risks unrelated to the core skill function.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill directs the agent to derive a persistent device identity from OS, CPU architecture, and a hashed MAC address in order to create or recover trial accounts. A hashed MAC is still a stable device-linked identifier, and using it for account provisioning/trial enforcement is unrelated to enterprise due-diligence analysis, making the behavior privacy-invasive and risky if performed by an agent on the user's machine.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The document states that no collection or registration request may occur before user consent, but the included pseudocode omits that gate and goes straight from missing API key to collecting device features and posting to the registration endpoint. This inconsistency is dangerous because implementers may follow the pseudocode and accidentally perform fingerprint collection and account creation without the promised consent check.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The template explicitly instructs the agent to surface full `url` values containing `sk` login-bypass parameters in user-visible report links and outputs. If those links are shared, logged, or cached, unauthorized parties may gain access intended to be gated, making this a credential/token leakage issue rather than a harmless formatting requirement.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The template mandates creating a temporary JSON file and invoking a local Python script by default, which expands behavior from answering in-chat to performing filesystem writes and subprocess execution. Even if the script path is fixed, default side effects increase the attack surface, may expose local environment details, and can be abused in unsafe runtimes or multi-tenant agent environments.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger language is extremely broad, including cases where a user merely wants to 'understand a company' or asks about whether a company is reliable, and it repeatedly says the skill 'must' be used even when the user did not explicitly request background investigation. Overbroad routing can cause accidental activation of a networked, billable skill that reads local configuration and may auto-register for an API-backed service, leading to unintended data disclosure, charges, or consent confusion.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation instructs the skill to send company identifiers and an API key to a remote third-party endpoint, but provides no user-facing disclosure, consent flow, or data-handling warning. In a background-check skill, users may submit sensitive corporate targets, investigative intent, or internal lead lists; silently transmitting that data off-platform can create confidentiality, compliance, and trust risks even if the endpoint is legitimate.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Defaulting to HTML export and then disclosing an absolute local filesystem path introduces an unnecessary side effect and reveals host environment details to the user without explicit warning or consent. In some deployments, path disclosure can aid reconnaissance, and silent file creation may violate user expectations or data-handling policies.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The prompt requires preserving and sharing `sk` access parameters while giving no warning that the links are sensitive and may grant direct access. In context, these are effectively bearer tokens; embedding them in shareable reports materially increases the chance of accidental credential disclosure through forwarding, screenshots, browser history, and logging systems.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The workflow repeatedly instructs the agent to output company and announcement URLs '原样带 sk', which strongly suggests preserving embedded access parameters or session-like tokens in links. Exposing such URLs to end users or downstream logs can leak bearer-style access, enabling unauthorized reuse, scraping, or access to account-scoped data beyond the intended session.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill hardcodes use of custom authentication headers for outbound API calls but provides no privacy notice, data handling constraints, or credential-safety guidance. In practice this increases the chance that an agent will send user-supplied company data to a third-party service without transparency, and that implementers may mishandle API keys in prompts, logs, or debugging output.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The script explicitly documents and renders raw URLs that may contain 'sk' tokens into exported HTML, including clickable links in multiple sections. If those tokens confer authenticated access, anyone who receives the HTML file can reuse the embedded links, causing credential leakage and unauthorized access to company dossiers or member-only data.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.