弱电智能化投标决策-安防监控项目投标评估

• Outcome: Review
• Latest audit: Jul 17, 2026 · 10:01 PM UTC
• Version: 1.0.3

Overview

The skill’s bid-analysis purpose is mostly coherent, but it adds persistent credential/account flows and exports shareable reports containing signed access links without enough containment.

Install only if you are comfortable with this skill contacting the vendor’s services, optionally creating an account after consent, storing an API key under your home directory, writing reports locally, and including signed vendor links in reports. Treat generated reports and their links as confidential.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill explicitly documents local file read/write behavior (reading user-provided bid files and writing reports/config under the user's home directory) while the metadata declares only an environment variable requirement and no corresponding permissions model. This creates a transparency and policy gap: users and hosting systems may not accurately understand or constrain filesystem access, increasing the risk of unexpected local data exposure or overwriting files if execution safeguards are weak.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 80% confidence
• Finding: The skill claims to perform data-driven bid-decision analysis but, per the finding, also includes report export and external-link behavior without implementing the core retrieval/analysis logic described to users. That mismatch is dangerous because it can mislead users into trusting unsupported conclusions, while still causing side effects such as file generation, external navigation, or branded output that appears authoritative despite lacking the promised evidence base.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file defines automatic account registration, API key acquisition, credential persistence, and recharge/login flows that are outside the stated purpose of a bid-decision analysis skill. Even though the document frames the behavior as a convenience feature, it instructs the agent to collect device-derived identifiers, contact a remote service, and store credentials locally, which meaningfully expands the skill’s power and attack surface beyond user-expected analysis behavior.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill instructs collection of device fingerprinting data (`platform`, `arch`, `mac_hash`) and local persistence of an API key in `~/.zlbx/config.json`, neither of which is necessary for tender decision analysis. A hashed MAC address is still a stable device identifier, and combining fingerprinting with local credential storage creates privacy, tracking, and secret-handling risks that exceed the skill’s declared scope.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The quota-exhaustion flow generates device/account-linked auto-login or recharge links using a server-issued SID, which is unrelated to the skill’s analytical purpose and introduces account access workflow into skill behavior. If mishandled, such links can enable session hijacking, confused-deputy behavior, or unauthorized account transitions, especially when triggered automatically by the agent.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The template explicitly instructs the agent to preserve and expose full signed URLs containing the `sk` access parameter in user-facing Markdown, JSON, and generated HTML. Because the text states that removing `sk` would trigger a login wall, these links function as bearer-style access tokens; disclosing them broadly can bypass normal authentication controls and enable unintended sharing or reuse.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The skill mandates invocation for a broad set of loosely related requests, including cases where the user does not even mention the core domain term. Overly broad routing increases the chance of unintended activation, causing unnecessary external API calls, account registration prompts, data disclosure to third-party services, and user steering into a workflow with cost and side effects they did not explicitly request.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill mandates automatic HTML export in the default flow and instructs disclosure of the absolute local file path to the user, without any warning, consent step, or storage-handling guidance. This creates unnecessary file generation side effects and may expose host filesystem layout or leave sensitive business intelligence artifacts stored on disk where they can persist beyond the session.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The instructions require preserving original signed URLs with access-enabling parameters in outputs, but provide no warning that these links may be sensitive or transferable. In this skill context, reports are meant to be shared and exported, which increases the chance that authenticated-access links are redistributed to unintended recipients.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The workflow explicitly instructs the agent to read a local bid document whenever the user provides one, but it does not require any user-facing consent, path restrictions, or validation that the file is the intended upload. In an agent setting, this can normalize unsafe file access behavior and may lead to accidental reading of sensitive local files if a prompt or ambiguous reference causes the agent to access the wrong path.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.