水滴信用企业尽调-合作前的轻尽调

• Outcome: Review
• Latest audit: Aug 14, 2026 · 6:50 AM UTC
• Version: 1.0.2

Overview

The skill is a real due-diligence/reporting integration, but it embeds login-bypass links and performs consent-gated device registration and credential persistence that users should review carefully.

Install only if you are comfortable with this vendor account model: it may create a trial account after consent, send a hashed device identifier for trial deduplication, store an API key under ~/.zlbx/config.json, and save due-diligence reports under ~/zlbx-company-intel-files/. Treat generated reports and platform links as sensitive because they intentionally include sk login-bypass parameters that may grant access when shared.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill explicitly instructs local file reads (`~/.zlbx/config.json`) and writes reports to `~/zlbx-company-intel-files/`, but the static finding indicates these capabilities are not declared in permissions. Undeclared filesystem access weakens least-privilege guarantees and can surprise users or the platform, especially because config files may contain API credentials and written reports may contain sensitive business intelligence.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 78% confidence
• Finding: The skill is presented as a due-diligence analysis assistant, but the behavior described includes report rendering/export, branding, upsell links, and use of precomputed JSON rather than clearly bounded analytical processing. This mismatch can mislead users about what the skill actually does, expanding trust and data-sharing beyond the user’s expectation and creating a risk of covert marketing or undisclosed data handling in a security-sensitive due-diligence workflow.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file embeds a full auto-registration, device fingerprinting, remote account creation, and credential persistence workflow inside a due-diligence skill whose stated purpose is company risk analysis. Even with disclosed collection and a consent prompt, the capability materially exceeds business need and gives the skill authority to inspect the local environment, transmit device-derived identifiers to a third party, and write secrets to disk. The mismatch between declared purpose and actual behavior makes this especially risky because users invoking a due-diligence assistant would not reasonably expect endpoint enrollment behavior.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill instructs the agent to inspect the host OS and collect architecture plus a hashed MAC-derived device identifier using platform-specific shell and PowerShell commands. Those actions are unrelated to enterprise due-diligence analysis and create a device fingerprint that can be used for tracking, correlation, and account binding across sessions. In this context, the skill's functional domain makes the capability more suspicious, not less, because endpoint fingerprinting is orthogonal to company-intelligence tasks.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The file directs the agent to read environment variables and local configuration files to obtain API keys, then later write credentials back to ~/.zlbx/config.json. Accessing and persisting local secrets/configuration is unrelated to producing due-diligence reports and expands the skill's privileges into credential management, increasing the chance of unintended exposure, overwrite, or misuse of locally stored authentication material.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill can call a backend endpoint to generate a device-bound SID and then present an auto-login/recharge URL to the user. That capability is unrelated to due-diligence reporting and introduces account-linking and session bootstrap behavior that could be abused for unauthorized account access workflows or phishing-style trust transfer if mishandled. Because the enclosing skill is supposed to analyze companies, not manage user billing or login state, this broadens the attack surface unnecessarily.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The template explicitly requires preserving and exposing full `sk` login-bypass parameters in company and announcement links shared with users. If `sk` functions as an access token or session-like bypass parameter, embedding it in reports increases the risk of unauthorized access, link leakage via forwarding/logging/referrers, and uncontrolled reuse outside the intended recipient.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The template directs the agent to generate an HTML report by default and write it to a local filesystem path outside the chat response. This creates an unintended data persistence channel for potentially sensitive business intelligence, increasing exposure through local file retention, shared hosts, backups, or later unauthorized access.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs retrieval and display of project contact phone numbers, including full numbers for paid accounts, and only constrains formatting rather than purpose, consent, or privacy compliance. In a due-diligence workflow this can expose personal contact data to end users for outreach, profiling, or bulk harvesting, creating privacy, abuse, and regulatory risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document instructs that returned URLs containing an `sk` login-bypass signature must be output unchanged, but provides no warning that these links may grant authenticated or semi-authenticated access if shared. This increases the chance that users or downstream systems will redistribute bearer-style signed links, enabling unintended access, leakage, or replay until the signature expires or is revoked.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: The skill instructs automatic HTML export as a default behavior without an explicit warning or fresh user consent. Even if the export is functionally legitimate, performing side effects by default can surprise users and cause unintended creation of shareable artifacts containing sensitive due-diligence data.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The workflow explicitly instructs the agent to record and output a company page URL '带 sk' and later says to output it '原样'. If the 'sk' parameter is an API key, session token, or other bearer secret, exposing it to end users leaks a reusable credential and can grant unauthorized access, quota consumption, or data exfiltration. In this skill context, the danger is increased because the report is intended for external sharing and repeated use, making systematic token leakage likely.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The workflow tells the agent to attach announcement links '原样带 sk', which again directs disclosure of embedded access material to the user. This creates a direct secret-leak path in normal operation; recipients can reuse the parameterized URLs outside the intended access boundary, potentially exposing paid data, consuming account resources, or bypassing authorization controls. Because these links are attached per finding and may be copied broadly, exploitation is straightforward.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The template not only preserves but specifically instructs exposing complete login-bypass `sk` parameters to users in output links. This is dangerous because such tokens can be copied, forwarded, indexed in logs, or leaked through browser referrers, effectively turning the report into a bearer-token distribution channel for otherwise gated content.

External Transmission

Medium

• Category: Data Exfiltration

Content

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>

• Confidence: 93% confidence
• Finding: requests.post(url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.