医疗设备商机雷达-医院采购早期发现

• Outcome: Review
• Latest audit: Jul 21, 2026 · 3:55 AM UTC
• Version: 1.0.2

Overview

The skill mainly matches its advertised lead-discovery purpose, but it persists account credentials and instructs agents to expose login-bypass links in shareable reports.

Review before installing. Use a manually configured API key if possible, understand that queries consume vendor credits, and avoid sharing generated reports unless signed sk links are removed or you are comfortable with anyone who sees the report using those links. Auto-registration should only be accepted if you are comfortable sending platform, CPU architecture, and a hashed MAC-derived identifier to the vendor.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill explicitly instructs local file reads from ~/.zlbx/config.json and local file writes to ~/zlbx-opportunity-radar-files/, but its metadata only declares an environment-variable requirement and does not declare corresponding file permissions. This creates a permission transparency gap: the agent may access local files beyond what a user would infer from the manifest, including sensitive configuration material if the implementation is broader than documented.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file instructs the agent to collect device-derived identifiers, call a remote auto-registration endpoint, and persist returned API keys locally, which is materially outside the stated purpose of a medical opportunity discovery skill. Even with consent text and MAC hashing, it creates an unnecessary credentialing and fingerprinting workflow that expands the skill’s authority, introduces privacy and supply-chain risk, and could be abused to enroll users or exfiltrate environment characteristics under the guise of normal skill operation.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill contains recharge, login-link generation, and account lifecycle instructions unrelated to medical lead discovery, which broadens the behavior from data retrieval into account management and marketing flows. That increases the chance of phishing-like user journeys, hidden monetization prompts, and misuse of active API credentials if the agent follows these steps automatically.

Vague Triggers

High

• Confidence: 90% confidence
• Finding: The trigger language is overly broad, including instructions to use the skill even when the user did not mention 'medical' as long as the request vaguely relates to hospital procurement or sales opportunities. This can cause unauthorized or surprising activation, leading to network queries, account registration prompts, local file access, and credit consumption in contexts where the user did not clearly request this specific capability.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly instructs that returned `url` values include an `sk` login-bypass parameter and should be output verbatim as directly clickable links. Exposing bearer-style access parameters in generated output can enable unauthorized reuse via forwarding, logging, browser history, analytics, or screenshots, especially in a sales-intelligence workflow where links are likely to be shared widely.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The template instructs the agent to write an HTML report to a local filesystem path and disclose that absolute path to the user, but it does not require an explicit warning or consent flow. This can leak host environment details such as usernames and directory structure, and it may create files unexpectedly in shared or sensitive runtime environments.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: The workflow tells the agent to direct users to an external site for more contacts and company archives, but it does not warn that using that site occurs outside the current environment or may involve separate privacy, authentication, and data-handling practices. In a sales-intelligence context, users may assume continuity of trust and share sensitive procurement leads or account information without realizing they are crossing a boundary.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The template explicitly requires exposing full API-returned URLs containing 'sk' login-bypass parameters directly to users and preserving them in Markdown and exported JSON/HTML. If those parameters function as bearer-style access tokens or bypass authentication, distributing them broadly can enable unauthorized access, uncontrolled sharing, replay, and long-lived leakage through chat logs, reports, browser history, and downstream systems.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.