企查猫企业情报-企业全景一次看清

• Outcome: Review
• Latest audit: Aug 14, 2026 · 2:19 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its company-intelligence purpose, but it intentionally preserves shareable login-bypass links and can expose contact data and account/session links in reports.

Install only if you are comfortable with this skill using a provider API key, spending provider credits, creating local report files, saving an API key under ~/.zlbx/config.json, and including signed sk links in chat/HTML reports. Treat generated reports and auto-login or signed links as sensitive and avoid forwarding them unless the recipient should have access.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill explicitly states it will read local configuration from ~/.zlbx/config.json and write HTML reports to ~/zlbx-company-intel-files/, yet only declares an environment-variable requirement and no corresponding file permissions. This creates hidden local file access beyond the declared capability surface, weakening user consent and making it easier for a skill to access or persist data on disk without clear permission disclosure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 81% confidence
• Finding: The skill is presented primarily as an enterprise-intelligence analysis tool, but it also performs local HTML rendering, creates directories, writes files, and embeds fixed branding/export behavior that is not reflected in the top-level declared purpose. This mismatch can mislead users and reviewers about the true operational scope, obscuring persistence and local side effects that may matter for privacy, storage, and trust decisions.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The activation rule is intentionally broad: it says the skill must be used whenever a user wants to '全面看清一家公司的业务、实力与竞争位置', even if the user did not mention intelligence analysis explicitly. Overbroad triggering increases the chance of routing ordinary company-related queries into a tool that performs networked lookups, possible auto-registration, local file writes, and cost-incurring actions without sufficiently specific user intent.

Vague Triggers

Low

• Confidence: 77% confidence
• Finding: The trigger phrase '给一个公司名' is too generic and can match many harmless requests, causing the skill to activate in contexts where a full investigative workflow is unnecessary. In this skill's context, that matters because activation may lead to external API calls, spending credits, local report generation, and potential collection of device-derived registration data after a consent prompt.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The workflow explicitly instructs the agent to output company-page and announcement URLs with the embedded `sk` parameter verbatim. If `sk` is an access token, session key, or user-scoped credential, echoing it back to end users or into logs/chats can leak reusable secrets and enable unauthorized access, account misuse, or unintended data sharing beyond the original session.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The workflow directs the agent to display contact phone numbers exactly as returned, including full numbers for paid accounts, and frames this as a product feature without any privacy or data-handling warning. This increases the risk of unnecessary disclosure of personal contact data, downstream scraping, and misuse of individuals' phone numbers, especially since the skill is designed to produce intelligence reports about third parties.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The template explicitly requires preserving and redisclosing full URLs containing `sk` access-bearing parameters, and further propagates them into generated HTML reports and user-visible output. If `sk` functions as a login-bypass or bearer-style access token, anyone who receives, forwards, or logs the link may gain unauthorized access to protected company pages or deeper report content, causing credential/token leakage and access-control bypass.

External Transmission

Medium

• Category: Data Exfiltration

Content

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>

• Confidence: 87% confidence
• Finding: requests.post(url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.