招标商机发现-还没发标先知道

• Outcome: Review
• Latest audit: Jul 21, 2026 · 3:55 AM UTC
• Version: 1.0.2

Overview

The skill mostly matches tender-opportunity discovery, but it also handles account creation, device-derived registration, local credential storage, and shareable signed links that users should review before installing.

Install only if you are comfortable with this skill contacting Zhiliaobiaoxun services, using or creating a ZLBX API account, storing the API key locally, collecting a hashed device identifier for trial registration if you opt in, and saving reports that may contain signed direct-access links. Prefer setting your own ZLBX_API_KEY, review generated reports before sharing them, and avoid installing on shared machines unless local credential and report files are acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill explicitly instructs local file reads from ~/.zlbx/config.json and writes output files under ~/zlbx-opportunity-radar-files/, but only declares an environment-variable requirement and no corresponding file permissions. This creates a permission/transparency gap: the runtime may grant broader filesystem access than users expect, and sensitive local data such as API keys in config files may be accessed without clear declaration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 77% confidence
• Finding: The skill description centers on finding tender opportunities, but the body adds local HTML report generation and export-oriented behavior that is not disclosed in the top-level purpose. Undisclosed file generation increases risk because users may not realize the skill persists potentially sensitive business-intelligence results locally, which can broaden data exposure on shared or monitored machines.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file documents an auto-registration and account-management flow inside a skill whose declared purpose is tender/opportunity discovery. That mismatch is dangerous because it expands the skill's behavior into credential provisioning, device-based account creation, and monetization flows that users would not reasonably expect from the manifest, increasing the chance of covert data collection and unauthorized account actions.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill collects device fingerprint material (platform, architecture, MAC-derived hash) for trial-account deduplication, which is unrelated to tender discovery and creates a persistent cross-session identifier. Even though the raw MAC is hashed, the value still functions as a stable device identifier and can enable tracking, silent account correlation, and privacy-invasive enrollment behavior if invoked by an agent.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to persist API keys to a local config file and reuse them across sessions, which goes beyond the stated business purpose and creates credential-handling risk. Local storage of bearer credentials can expose users to token leakage through permissive file permissions, unintended reuse, or conflicts with existing configuration managed outside the skill.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The quota-exhaustion flow generates an auto-login SID and directs the user into a recharge and phone-binding process, which is unrelated to opportunity discovery and introduces account takeover and monetization risk. Embedding billing-oriented login-link generation inside a domain skill normalizes sensitive auth flows in contexts where users are not expecting account management actions.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The template explicitly instructs the agent to reveal full API-returned URLs, including `sk` login-bypass parameters, directly to the user. If `sk` functions as an access token or session-bearing bypass parameter, exposing it can leak authenticated access, enable unintended sharing, and allow recipients or third parties to access protected resources without normal login controls.

Vague Triggers

High

• Confidence: 88% confidence
• Finding: The activation rules are extremely broad and mandate use of this skill even when the user did not explicitly request it, covering loosely related intents such as lead generation, customer development, and market opportunities. Over-broad forced invocation can route unrelated user queries into external API calls, causing unnecessary data disclosure, unwanted billing, and bypass of user intent confirmation.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The template repeatedly requires preserving and disclosing full raw URLs with `sk` and related parameters in both Markdown and generated HTML/JSON outputs. This increases the blast radius beyond the chat response: sensitive access-bearing links may be stored in files, shared externally, logged, cached, or reused by unauthorized parties, effectively turning a transient bypass token into a persistent secret leak.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.