Security audit

拟建项目跟踪-立项审批阶段就发现

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a disclosed business-opportunity API assistant, but it intentionally outputs login-bypass signed links and persists account credentials, so users should review it before installing.

Install only if you are comfortable sending opportunity-search keywords to Zhiliaobiaoxun, storing an API key under ~/.zlbx/config.json, and generating local HTML reports. Treat any sk or auto-login links produced by the skill as private access links and avoid sharing exported reports without checking those URLs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill explicitly instructs reading a local config file (`~/.zlbx/config.json`) and writing reports to `~/zlbx-opportunity-radar-files/`, yet it declares no corresponding permissions. That creates a transparency and consent gap: the agent may access local files and persist outputs in ways the permission model does not surface to the user.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: This document instructs the agent to perform an unrelated auto-registration workflow that collects device fingerprints, creates remote accounts, persists API keys locally, and later drives recharge/login flows. For a project-tracking skill, that is unnecessary privilege expansion and creates a path for silent credential provisioning, host data collection, and persistent state changes on the user's machine.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The privacy notice says the collected device features are only for free-trial deduplication, but later instructions reuse the resulting account for recharge, auto-login, and phone-binding related flows. That inconsistency is a deceptive data-use statement: users may consent under a narrower purpose than what the workflow actually enables.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The skill says it 'must' be used even when the user did not explicitly mention this skill, for a broad class of opportunity/project queries. Over-broad activation can route user requests to external APIs unnecessarily, causing unintended data disclosure, surprise billing/credit consumption, and execution of side effects such as report generation or auto-registration prompts.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The workflow explicitly tells the agent to output links containing an `sk` auto-login parameter that can grant direct authenticated access when clicked or shared. Exposing bearer-style login parameters in normal output increases the chance of account/session leakage through chat logs, screenshots, browser history, link previews, referrers, or accidental forwarding, especially in a business-intelligence workflow where results may be redistributed internally.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The subscription instructions encourage users to embed full business queries into `/loop`, cron jobs, CLI commands, or third-party agent messages without warning that those strings may be stored in shell history, process lists, cron files, logs, or external platforms. This can leak sensitive commercial intent, target regions, industries, and monitoring strategy to administrators, coworkers, or service providers, which is particularly relevant for early-opportunity discovery use cases.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The template explicitly requires exposing API-returned full URLs containing an `sk` login-bypass parameter to end users. If that parameter acts as an access token or session-bearing bypass key, sharing it leaks a bearer secret that can be reused, forwarded, logged, or indexed, enabling unauthorized access beyond the immediate conversation.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.