建筑工程投标决策-施工项目投标评估

• Outcome: Review
• Latest audit: Jul 17, 2026 · 10:02 PM UTC
• Version: 1.0.3

Overview

This skill is a legitimate bid-analysis tool, but it asks agents to create accounts, store credentials, fingerprint the device, and generate shareable reports with signed access links.

Review this skill before installing. Prefer configuring your own ZLBX_API_KEY instead of auto-registration if you do not want device-derived identifiers collected or credentials written to ~/.zlbx/config.json. Treat generated HTML reports as sensitive business documents, and do not share them casually because they may include signed sk links that grant access to source records.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill explicitly instructs local file reads and writes (reading user-provided tender files, storing reports, and storing credentials in ~/.zlbx/config.json) while the metadata declares only an environment-variable requirement and no corresponding permissions. This mismatch can lead to undeclared access to sensitive local data and weakens user/admin ability to assess what the skill can actually touch.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill directs automatic account registration using device fingerprinting inputs such as platform, architecture, and a MAC-derived hash. Even with consent language, collecting and transmitting device-derived identifiers is privacy-sensitive and extends beyond the core need of analyzing bid history, creating unnecessary tracking and consent-risk surface.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The manifest frames the skill as a bid-analysis assistant, but the instructions also include local credential management, config-file access, and account onboarding workflows. Mixing analysis with credential discovery and persistence broadens the trust boundary and can expose secrets or user environment details unrelated to the core task.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file instructs the agent to perform automatic account registration, collect device-derived identifiers, persist credentials locally, and handle recharge/login flows. That behavior materially exceeds the stated purpose of a construction tender analysis skill and creates an unnecessary capability for account provisioning and local state mutation, which broadens the attack surface and can trigger networked actions unrelated to the user's bidding task.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill directs the agent to collect platform, CPU architecture, and a hashed MAC-derived identifier for trial-account deduplication. Even if the raw MAC is not transmitted, this is still device fingerprinting unrelated to tender analysis, enabling user/device tracking and creating privacy risk if performed by an agent under a business-analysis skill context.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The instructions tell the agent to write API keys into ~/.zlbx/config.json, merge config state, use the key immediately, and generate auto-login/recharge links when balance is exhausted. These persistence and account-management behaviors are outside the declared scope of bid decision support and can cause unauthorized local secret storage, unexpected account linkage, and confusing credential side effects.

Intent-Code Divergence

Medium

• Confidence: 81% confidence
• Finding: The document contains conflicting behavioral instructions: suppressing some auto-registration guidance in one condition while later mandating recharge guidance in another. This inconsistency can lead an agent to produce unexpected account-related prompts or links, undermining predictable consent boundaries and making unsafe side effects more likely.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The template explicitly instructs the agent to preserve and expose full signed URLs containing `sk` parameters, describing them as a way to bypass the login wall. If those URLs function as bearer-style access tokens, disclosing them to users or embedding them in exported reports can leak authenticated access, enable unauthorized sharing, and bypass intended access controls.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The template mandates running a local script to generate an HTML file and then disclosing the absolute filesystem path to the user. Default file creation plus path disclosure can expose host environment details, create unintended persistence of potentially sensitive report data, and expand the attack surface through external script execution in an agent workflow.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to generate an HTML export by default and present a shareable path without informing the user that a file will be created and retained. This undermines user consent and can cause unanticipated data exposure or retention, especially because tender analysis reports may contain commercially sensitive information and embedded source links.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.