建筑工程商机雷达-基建项目早期发现

• Outcome: Review
• Latest audit: Jul 21, 2026 · 3:55 AM UTC
• Version: 1.0.2

Overview

The skill performs the advertised opportunity searches, but it also handles account setup, persistent credentials, device fingerprinting, scheduled runs, and shareable login-bypass links that users should review carefully.

Install only if you are comfortable with this vendor receiving your search terms and, if you use automatic trial registration, a hashed MAC-based device identifier. Prefer setting your own ZLBX_API_KEY manually. Treat generated HTML reports and sk links as sensitive: avoid posting or forwarding them publicly, and disable any cron or /loop schedule when you no longer need monitoring.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill explicitly instructs reading from `~/.zlbx/config.json` and writing reports to `~/zlbx-opportunity-radar-files/`, but only declares an environment-variable requirement and no corresponding file permissions. This creates a permission-model gap: the runtime or reviewer may not realize the skill accesses local files, weakening consent, sandboxing, and audit expectations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The declared purpose is opportunity discovery, but the skill also directs generation of self-contained HTML reports with embedded links and export features. That mismatch matters because report generation introduces additional behaviors—file creation, rendering untrusted API content into HTML, and distribution-oriented outputs—that expand the attack surface beyond what a user might infer from the description.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This document adds an auto-registration and account-management workflow to a skill whose declared purpose is construction opportunity discovery. It instructs the agent to collect device-derived identifiers, contact a remote registration endpoint, persist credentials locally, and handle billing/recharge flows, all of which materially exceed the minimum scope needed for project-intelligence queries. In a skill context, this is dangerous because it normalizes unrelated data collection and remote account provisioning under the guise of fulfilling a user query.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill explicitly instructs the agent to run OS-specific commands to derive a hashed MAC address and collect platform/architecture data for device deduplication. Even if the raw MAC is not transmitted, this is still device fingerprinting and is unrelated to the stated business purpose of finding construction opportunities. The skill context makes this more dangerous because users asking for market/project leads would not reasonably expect local hardware fingerprint collection as a prerequisite.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The document directs the agent to write API credentials to ~/.zlbx/config.json and merge them into existing local configuration. Persisting newly issued credentials on the user's machine is sensitive behavior outside the declared scope of a construction-opportunity skill, and it creates risk of unintended secret storage, cross-tool reuse, or leakage from local files. The mismatch in scope increases concern because credential management is being embedded in an unrelated skill rather than handled through normal secure setup paths.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill contains logic for balance exhaustion, device-SID generation, and auto-login/recharge link creation, which is unrelated to delivering construction opportunity intelligence. This expands the skill into account monetization and authentication flows, increasing the attack surface and creating opportunities for phishing-like link generation or user confusion about what actions the agent is authorized to perform. In this context, the behavior is unjustified and therefore higher risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The workflow explicitly instructs users to configure unattended periodic execution via /loop, cron, or other schedulers, but it does not warn that each run will automatically make external API requests and transmit query parameters on an ongoing basis. This can lead to silent recurring network activity, unexpected data exposure, cost accumulation, and continued monitoring behavior after the user may have forgotten the automation is active.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The template explicitly requires exposing full API-returned URLs including the `sk` parameter and warns not to remove it because it bypasses the login wall. That means the skill is instructed to disclose access-bearing links directly to end users, which can leak bearer-style access tokens, enable unauthorized access if shared, and propagate sensitive URLs into chats, logs, and downstream systems.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The HTML export flow instructs the agent to copy the same raw access-bearing URLs into JSON and generated report artifacts, increasing the number of places secrets can persist. This amplifies exposure because tokenized links may be written to temp files, reports, shell history, telemetry, backups, and shared HTML files, making accidental disclosure and reuse much more likely.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.