精准寻标与获客引擎-寻标宝

PassAudited by ClawScan on May 9, 2026.

Overview

This is a disclosed, instruction-only tender-data lookup skill that uses a service API key and external provider calls; users should be aware of credential use, query sharing, and automatic company matching.

Install only if you trust the Xunbiaobao/Zhiliaobiaoxun API provider with your tender-search queries and are comfortable providing a ZLBX_API_KEY. For ambiguous company names, ask the agent to confirm matched entities before expanding to subsidiaries or running broad follow-up searches.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

If the key is exposed or used unexpectedly, the user’s service quota or account access could be affected.

Why it was flagged

The skill requires and uses a provider API key for authenticated requests. This is expected for the stated API integration, but the key represents account access and likely usage quota.

Skill content

Headers:\n  X-API-Key: $ZLBX_API_KEY ... API Key: - 从环境变量 `ZLBX_API_KEY` - 从Agent配置文件中读取。

Recommendation

Use a dedicated ZLBX_API_KEY with appropriate limits, do not share it in prompts, and rotate it if you suspect exposure.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Tender searches and business-analysis queries may be visible to the external API provider.

Why it was flagged

The skill sends search parameters and authenticated requests to an external API provider. This is disclosed and purpose-aligned, but user-entered company names, products, regions, and analysis goals may leave the local agent context.

Skill content

基础 URL: `https://mcp-server.zhiliaobiaoxun.com/api_v2/{工具名}` ... 调用方式: POST 请求

Recommendation

Avoid submitting confidential strategy, private customer lists, or sensitive internal identifiers unless you trust the provider’s data handling.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The agent may include more companies than the user intended, which can affect result accuracy and consume API quota.

Why it was flagged

The skill instructs the agent to automatically select related company entities and use all matching headquarters/subsidiary results without pausing for confirmation. This is useful for broad company analysis but can widen the query scope.

Skill content

自动匹配，无需用户确认：调用后由 LLM 根据公司名称语义自动筛选相关结果，将所有匹配公司（总部+各地分子公司）一并用于后续查询，不打断用户流程。

Recommendation

For ambiguous company names or cost-sensitive searches, ask the agent to show matched companies before running follow-up queries.