临期续约商机-合同到期窗口挖掘

• Outcome: Review
• Latest audit: Jul 21, 2026 · 3:55 AM UTC
• Version: 1.0.2

Overview

This skill matches its business-opportunity purpose, but it needs Review because it stores credentials locally, uses device-derived registration, and preserves login-bypass links in shareable reports.

Review before installing. Prefer supplying ZLBX_API_KEY through your environment to avoid automatic registration. If you use the free-trial flow, understand that it collects platform, CPU architecture, and a hashed MAC-derived value, then stores an API key in ~/.zlbx/config.json. Treat generated HTML reports and any sk-bearing links as sensitive; do not share them broadly unless you are comfortable granting access through those links.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill explicitly instructs local file reads from ~/.zlbx/config.json and writes reports to ~/zlbx-opportunity-radar-files/, but the metadata only declares an environment variable requirement and no corresponding file permissions. This creates a capability/permission mismatch that can surprise users and bypass least-privilege expectations, especially because local config files may contain reusable secrets.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: The declared purpose focuses on finding expiring contracts and renewal opportunities, but the skill also generates branded offline HTML reports with export/print behavior not reflected in the high-level description. Hidden output-generation behavior increases data handling scope and may cause users to disclose, persist, or redistribute sensitive procurement results without realizing the skill creates durable local artifacts.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This document embeds a full auto-registration, device-fingerprinting, remote account creation, and credential persistence workflow inside a skill whose stated purpose is contract-renewal and opportunity discovery. That is a clear scope violation: it instructs the agent to collect local system attributes, contact an external service, and modify local configuration, which materially expands the skill's authority and creates privacy and security risk unrelated to user intent.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The file instructs the agent to gather device characteristics such as platform, CPU architecture, and a hashed MAC-derived identifier, then use them to register a trial account with a third-party service. Even with claimed minimization and consent text, this is unrelated to procurement-opportunity analysis and creates an unnecessary device fingerprinting channel that can track users or systems across sessions.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The document directs the agent to create or modify ~/.zlbx/config.json and persist an API key locally, including metadata fields controlling future behavior. For a business-opportunity skill, silently mutating user configuration and storing credentials increases the blast radius of compromise, can overwrite or interfere with existing settings, and establishes persistence beyond the current task.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The template explicitly requires exposing full API-returned URLs including `sk` login-bypass parameters to users. Tokens in URLs are effectively bearer secrets: anyone who receives, logs, forwards, or screenshots the link may gain unintended access, and such URLs can also leak via browser history, referrers, chat logs, and exported reports. In this skill context, the instruction is more dangerous because it mandates broad disclosure both in chat and generated artifacts, increasing token propagation.

Context-Inappropriate Capability

Low

• Confidence: 87% confidence
• Finding: The template instructs default generation of a local HTML file and disclosure of its absolute filesystem path to the user. While not as severe as token leakage, revealing internal filesystem paths can disclose environment details, usernames, directory layouts, or deployment conventions that help attackers fingerprint the host or target local files; auto-generating files by default also expands the data exposure surface. The skill context makes this somewhat more concerning because it couples local artifact creation with user-facing disclosure on every full report flow.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document instructs callers to send an `X-API-Key` header but does not label the key as sensitive, warn against exposing it in logs or client-side code, or describe secure storage/rotation expectations. In an agent skill context, this increases the chance that downstream implementations hardcode or echo credentials, leading to credential leakage and unauthorized API use.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documentation explicitly says returned `url` values include an `sk` login-bypass parameter and may be output directly for click-through use. Treating bearer-style access links as harmless URLs is dangerous because they can be copied, logged, shared, cached, or exposed in chat transcripts, enabling unauthorized access without normal authentication.

Ssd 3

High

• Confidence: 99% confidence
• Finding: This broader instruction repeatedly requires preserving and disclosing full API links containing login-bypass token parameters in both chat output and JSON/HTML exports. That creates a direct secret-handling failure: authentication material is intentionally propagated into user-visible content and durable files, making unauthorized reuse, sharing, indexing, and logging highly likely. The skill context materially increases risk because the behavior is not incidental—it is a required formatting rule across multiple output channels.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.