IT信息化商机雷达-信创项目早期发现

• Outcome: Review
• Latest audit: Oct 14, 2026 · 9:47 AM UTC
• Version: 1.0.8

Overview

The skill is mostly aligned with finding IT project opportunities, but it also handles account registration, device fingerprinting, stored API keys, billing links, and hidden request instructions that deserve review before installation.

Review this skill before installing if you are not comfortable with a third-party provider managing trial accounts from inside the agent. It may contact zhiliaobiaoxun.com domains, use or create an API key, store that key under ~/.zlbx/config.json, collect a hashed MAC address during auto-registration after consent, and generate local HTML reports. Preconfiguring ZLBX_API_KEY avoids the auto-registration path.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (30)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The activation rule says the skill must be used even when the user does not mention IT, as long as the request vaguely relates to project leads or early opportunity discovery. This is overly broad and can cause unintended invocation on unrelated business or government-opportunity requests, leading to unnecessary external API calls, local file creation, and possible registration/account actions the user did not clearly request.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

完整模式下，对话清单输出后默认再用 `scripts/render_report.py` 生成一份可分享的 HTML 版商机清单并告知保存路径（详见 report-template.md「HTML 报告导出」）。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

完整模式下，对话清单输出后默认再用 `scripts/render_report.py` 生成一份可分享的 HTML 版商机清单并告知保存路径（详见 report-template.md「HTML 报告导出」）。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 92% confidence

Finding

The hidden HTML-comment block contains operative instructions that are not visible to normal users, including mandatory request headers, account-balance checks, user-visible notice handling, and acknowledgment behavior. Hidden instructions create a transparency and trust problem because they can alter network behavior and state-changing actions without clear disclosure, and they may bypass normal review expectations.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

• 用户想持续跟踪 → 介绍订阅模式（见上方「订阅模式」）
• 以上都不贴切 → 询问是否要对某条高价值商机深挖，或引导访问知了商机大师 https://agent.zhiliaobiaoxun.com

安装包身份与升级检查：所有发往知了标讯 API 的请求（包括账户查询）必须额外携带以下两个请求头：

text

X-Skill-Package: it-project-opportunity-radar/1.0.8

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 92% confidence

Finding

The hidden HTML-comment block contains operative instructions that are not visible to normal users, including mandatory request headers, account-balance checks, user-visible notice handling, and acknowledgment behavior. Hidden instructions create a transparency and trust problem because they can alter network behavior and state-changing actions without clear disclosure, and they may bypass normal review expectations.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

• 用户想持续跟踪 → 介绍订阅模式(见上方「订阅模式」)
• 以上都不贴切 → 询问是否要对某条高价值商机深挖,或引导访问知了商机大师 https://agent.zhiliaobiaoxun.com

安装包身份与升级检查:所有发往知了标讯 API 的请求(包括账户查询)必须额外携带以下两个请求头:

text

X-Skill-Package: it-project-opportunity-radar/1.0.8

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-quick.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: opportunity-radar/1.0.3

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-quick.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: opportunity-radar/1.0.3

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 95% confidence

Finding

The file embeds hidden operational instructions in comments telling the agent which identity headers to send and how to preserve package attribution. Hidden instructions are dangerous because they can influence agent behavior in ways not visible to the end user, especially around network requests and request metadata.

Content

Scanner excerpt · references/auto-register.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: opportunity-radar/1.0.3

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 95% confidence

Finding

The file embeds hidden operational instructions in comments telling the agent which identity headers to send and how to preserve package attribution. Hidden instructions are dangerous because they can influence agent behavior in ways not visible to the end user, especially around network requests and request metadata.

Content

Scanner excerpt · references/auto-register.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: opportunity-radar/1.0.3

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file defines an automatic account lifecycle workflow—device fingerprint collection, remote registration, API key retrieval, persistence to disk, balance checks, and recharge/auto-login flows—that is materially broader than the declared purpose of discovering IT project opportunities. This creates unnecessary authority expansion and introduces credential-handling and tracking behaviors that a user would not reasonably expect from a lead-radar skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instructions direct the agent to inspect local environment variables and config files for API keys and, if absent, collect device fingerprints including OS, CPU architecture, and a MAC-derived hash for transmission to a third-party service. Even with claimed minimization and consent text, this is unrelated to the core business function and increases privacy risk through host inspection and persistent device tracking.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs writing the returned API key into ~/.zlbx/config.json and reusing it automatically in later sessions. Persisting third-party credentials to local disk from within a lead-generation skill exceeds expected scope and can expose secrets to other local processes, backups, or users if file permissions are weak or the path is shared.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 93% confidence

Finding

This duplicate finding points to the same hidden-instruction block embedded in comments at the top of the template. Even if the content appears operationally legitimate, embedding request-authentication and source-control directives in hidden prompt text creates a prompt-injection surface and obscures security-relevant behavior from users and reviewers.

Content

Scanner excerpt · references/report-template.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: opportunity-radar/1.0.3

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 93% confidence

Finding

This duplicate finding points to the same hidden-instruction block embedded in comments at the top of the template. Even if the content appears operationally legitimate, embedding request-authentication and source-control directives in hidden prompt text creates a prompt-injection surface and obscures security-relevant behavior from users and reviewers.

Content

Scanner excerpt · references/report-template.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: opportunity-radar/1.0.3

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 94% confidence

Finding

The hidden comment block is a true prompt-level control channel that instructs the model to preserve and transmit package identity and credential-bearing request metadata. In a skill that drives external API access, concealed instructions are especially dangerous because they can override safer orchestration logic and cause the agent to make authenticated outbound requests without transparent user awareness.

Content

Scanner excerpt · references/workflow.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: opportunity-radar/1.0.3

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 94% confidence

Finding

The hidden comment block is a true prompt-level control channel that instructs the model to preserve and transmit package identity and credential-bearing request metadata. In a skill that drives external API access, concealed instructions are especially dangerous because they can override safer orchestration logic and cause the agent to make authenticated outbound requests without transparent user awareness.

Content

Scanner excerpt · references/workflow.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: opportunity-radar/1.0.3

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 50% confidence

Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/render_report.py (reported line 64)May include surrounding context.

python

ROUTE_COLOR = {"拟建": "#7c5cbf", "意向": "#0b7a6a", "临期": "#b9770e"}

# 知了标讯白色 logo（299x96 PNG base64 内嵌，保证报告离线/打印/转发时不裂图）
_LOGO_B64 = "iVBORw0KGgoAAAANSUhEUgAAASsAAABgCAYAAABFTFSvAAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAABK6ADAAQAAAABAAAAYAAAAACurZhBAAA2V0lEQVR4Ae2dB5xU1fXHzzZ6752ldxHpHTtqTKJJjEmMGkvKP/aIRk0UayzYxZJouokaYyzRiKCAoIB0kN47LB0WFnZh9//9vZmHb4eZnZndmWVW3vl8fjOv3fvuO+++3z3nvHvvM/PF14CvAV8DFUADafbM2OusKOMCKywoqgDlDV/ENIpemJ5vGYW5VmjbrChtlaXZYks7usRuumlb+ET+Vl8DvgYqkgYyzdJ6WqWskXa0IhU7UlnTzLgiK4K8jh7litK22FPPT4O03rb8zAk26hc5kVL6230N+BpIbQ1kWpEdsYJ8Hu4jqV3SeEuXlpZBkhaWmf49s/RvW9aRFfbs2D9ZweF/2i23bIo3O/94XwO+Bk6sBtJP7OmTeHZZV0JBgdmRI1mWnt7V0jIesozK7+H6/shGj66UxLP7Wfsa8DWQYA18fcnKq6iAWxggrbS0XpDWc1a34dP2zDMtvIf5y74GfA2krgZODrJy9e+SVuHROpae8ROC8i/bsy/1cHf7/74GfA2krgZOLrJy70NhoWJ0lXENz8Tces6eHHuqu8v/9zXgayA1NXBykpXuhayswkJeMKQPtHR7greGnVLzFvml8jXga0AaOHnJSlfvENbRLEtLG2BphaPtiSfqabMvvgZ8DaSeBk5ustL9EGEVFVW1jIwzLC3rlyzTWcsXXwO+BlJNAz5Z6Y4ohnXkaCPLSP++PfnCkFS7SX55fA34GjjZ3cDjakBatqUduQZ3sOpxu/wNvgZ8DZxQDfiWlav+gDtY3TKz+plVHupu9v99DfgaSA0N+GTlvQ8Bwmpm6YUX2htvaLiOL74GfA2kiAaST1bEr5Miycq3sLAm5e1jG7e3SUq5/Ux9DfgaKJUGkkNWRxgUfUSTHjAJQjqnKGRZ6wpklyQByybyEZpIQeC4jHQy1/HKV9sSIcovLS0NV7ARhcUd9MXXgK+BVNGAJlRJnEBGVbOy7Lz2be1bbdtax3p1LYtnf1tenk3euMneWrHSVu7cbTCNSAGyUU9yCILV9IxMq5KVaUfZdPioBh9DQDomTXxaZNUyM613s2Z2UYe2dlrDhlaD8+w5nG8zt22zd1atthlbmcZKZChyLKsUFtWxtKJTyOYfZc3KT+9rwNdAYjSQZk8//wKk8POyThGTAfF0b9DQHh022M5p3eq40slr27R/vz06a649N28uYSGzVnXr2vltWtvpLVpY29q1rHqlLDsC4ew8dMjm5+yw91avsbk5260mxHRr3952eZdOVp3lUNHxf1m01B6bNdu25uZChmUINzkEmXYIa+1dGPNKppPJCz2fv+5rwNdA+WsgIZZVBpbPKQ0b2avnn2tdsKaO4E6t3L3bpm/ZagcKjjgW1sAmTaxFzZr20JCB1q1BPQwXw0pqZw2rhu8lMBQr6mendLecgwctl2leOkFsynfdvn32xdYcZ3vzmjWsb+NG1rxGDefYJtWr2k2Tpth20pTJwioqghHTGllWVl1uiU9W5V8v/TP6GjhOAwkhq/pVqth9gwY4RLU3P98enTnHnsd62pN32IkrZeLi9Wve1P5w1unWtX59+1mP7scVJNyGLFw6EZGkEKKat32H3Txxkk1du94ho0xcQ+V3W7/e9oNOHe2c7NZ2Q699ds/n05nduJTCeZAM4m01sK4UbPfF14CvgRTQQJnJqjJhpcHNm9t5uHP
...[truncated 27 chars]

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill explicitly states it will write HTML reports to a local directory, but it does not declare any tool scope, permissions, or allowed-tools boundary for file writing. That creates an authorization gap: a host may permit broader write behavior than users expect, and the skill can persist data locally without an explicit capability contract.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The recurring-monitoring guidance triggers on broad phrases like '持续盯着' or '每天看看有没有新机会' without a strict boundary for when subscription-like behavior should start. In context, this could push the skill toward repeated monitoring workflows, extra API consumption, and persistent operational behavior based on casual user phrasing rather than explicit opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file provides required user-facing wording entirely in Chinese and instructs the agent to relay it verbatim. Similar fixed Chinese output appears later for user prompts and notices, with no opt-in or alternative locale path, which creates a language-policy concern for users who may not prefer Chinese.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This location documents an outbound POST that serializes locally collected device features and sends them to an external auto-registration endpoint. External transmission of host-derived data is sensitive here because it supports account creation and device tracking unrelated to the advertised lead-discovery function.

Content

Scanner excerpt · references/auto-register.md (reported line 130)May include surrounding context.

md

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/auto-register.md (reported line 131)May include surrounding context.

md

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>
> 历史教训：曾有版本采集 `home_path`，Windows 的 `C:\Users\alice` 直接拼进 JSON 字符串时

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

The instructions explicitly create ~/.zlbx, merge configuration, write source metadata, and immediately reuse the persisted key in the current and future sessions. This is unauthorized session persistence and secret retention behavior that outlives the immediate task and increases the blast radius if the host is shared or compromised.

Content

Scanner excerpt · references/auto-register.md (reported line 195)May include surrounding context.

text

注意事项：
- 目录不存在时先 `mkdir -p ~/.zlbx`
- 文件已存在时**合并而非覆盖**（保留用户可能的其他配置）
- `source: "auto"` 字段必须写入，**这是后续判断「是否输出自动登录链接」的关键依据**

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

The instructions explicitly create ~/.zlbx, merge configuration, write source metadata, and immediately reuse the persisted key in the current and future sessions. This is unauthorized session persistence and secret retention behavior that outlives the immediate task and increases the blast radius if the host is shared or compromised.

Content

Scanner excerpt · references/auto-register.md (reported line 195)May include surrounding context.

text

注意事项:
- 目录不存在时先 `mkdir -p ~/.zlbx`
- 文件已存在时**合并而非覆盖**(保留用户可能的其他配置)
- `source: "auto"` 字段必须写入,**这是后续判断「是否输出自动登录链接」的关键依据**

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document adds balance polling, update-acknowledgement callbacks, and generation of auto-login recharge links, all of which are account-management functions unrelated to opportunity analysis. These extra network actions expand data sharing and create opportunities for unintended state changes on external services without clear necessity for the declared skill purpose.

Content

No source excerpt is available for this finding.