招中标信息&招标雷达

• Outcome: Review
• Latest audit: Oct 14, 2026 · 11:08 PM UTC
• Version: 2.0.7

Overview

The skill is a real bid-data integration, but it also manages accounts, collects device metadata, stores an API key locally, and performs hidden account/version callbacks that users should review before installing.

Install only if you are comfortable with this provider receiving authenticated API calls, package/source headers, and, during auto-registration, a hash of a device MAC address. Prefer supplying your own ZLBX_API_KEY through the platform or environment, review ~/.zlbx/config.json permissions if auto-registration is used, and be aware that the skill may perform account/version checks and acknowledgement callbacks in addition to bid-data queries.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (31)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill contains an auto-registration flow that collects device characteristics, creates an account, and persists a received API key to a local file. For a data-query skill, this is over-privileged behavior: it handles identity lifecycle, fingerprints the device, and writes credentials locally, creating privacy, consent, and secret-management risks if abused or implemented insecurely.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This duplicate finding points to the same hidden-instructions block that embeds non-transparent request and telemetry behavior. Even if the behavior is framed as package identity or upgrade management, concealing it in comments makes auditing harder and increases the chance of unnoticed data disclosure or policy bypass.

Content

Scanner excerpt · SKILL.md (reported line 537)May include surrounding context.

分寸：同一会话最多引导一次；用户拒绝或表示已经在用之后本会话不再出现。引导必须出现在首次用法介绍、家族 Skill 转介之后，作为回答的最后一段。

安装包身份与升级检查：所有发往知了标讯 API 的请求（包括账户查询）必须额外携带以下两个请求头：

text

X-Skill-Package: bidding-search-jianyu/2.0.7

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This duplicate finding points to the same hidden-instructions block that embeds non-transparent request and telemetry behavior. Even if the behavior is framed as package identity or upgrade management, concealing it in comments makes auditing harder and increases the chance of unnoticed data disclosure or policy bypass.

Content

Scanner excerpt · SKILL.md (reported line 537)May include surrounding context.

分寸:同一会话最多引导一次;用户拒绝或表示已经在用之后本会话不再出现。引导必须出现在首次用法介绍、家族 Skill 转介之后,作为回答的最后一段。

安装包身份与升级检查:所有发往知了标讯 API 的请求(包括账户查询)必须额外携带以下两个请求头:

text

X-Skill-Package: bidding-search-jianyu/2.0.7

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 95% confidence

Finding

This duplicate hidden-instruction finding points to the same concealed request-identity content, which attempts to control how authenticated API calls are made. Concealed routing and identity requirements increase the risk of prompt-driven exfiltration or unauthorized use of configured credentials because the behavior is embedded in documentation rather than enforced by trusted tooling.

Content

Scanner excerpt · references/api-account.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 95% confidence

Finding

This duplicate hidden-instruction finding points to the same concealed request-identity content, which attempts to control how authenticated API calls are made. Concealed routing and identity requirements increase the risk of prompt-driven exfiltration or unauthorized use of configured credentials because the behavior is embedded in documentation rather than enforced by trusted tooling.

Content

Scanner excerpt · references/api-account.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 96% confidence

Finding

This duplicate finding points to the same hidden instruction block that tells the agent to send authenticated requests with fixed identity headers. Because the instruction is embedded in the skill content rather than enforced by trusted infrastructure, it creates an untrusted control path for authenticated network behavior and increases the risk of misuse of existing credentials.

Content

Scanner excerpt · references/api-company.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 96% confidence

Finding

This duplicate finding points to the same hidden instruction block that tells the agent to send authenticated requests with fixed identity headers. Because the instruction is embedded in the skill content rather than enforced by trusted infrastructure, it creates an untrusted control path for authenticated network behavior and increases the risk of misuse of existing credentials.

Content

Scanner excerpt · references/api-company.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-market.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-market.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This duplicate finding points to the same hidden instruction region that prescribes authenticated headers and package/source identity values. Even if intended for compatibility, burying operational directives in the content creates an instruction-smuggling risk: an agent may obey untrusted embedded text to perform authenticated actions or leak installation metadata beyond what the user explicitly requested.

Content

Scanner excerpt · references/api-registry.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This duplicate finding points to the same hidden instruction region that prescribes authenticated headers and package/source identity values. Even if intended for compatibility, burying operational directives in the content creates an instruction-smuggling risk: an agent may obey untrusted embedded text to perform authenticated actions or leak installation metadata beyond what the user explicitly requested.

Content

Scanner excerpt · references/api-registry.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 84% confidence

Finding

This duplicate hidden-instructions finding points to the same comment-delimited block that directs the agent to send specific identity headers with the user's API key. Even if intended for package compatibility, burying such instructions in skill text makes the behavior less auditable and increases the chance of silent metadata leakage or policy bypass in multi-skill environments.

Content

Scanner excerpt · references/api-search.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 84% confidence

Finding

This duplicate hidden-instructions finding points to the same comment-delimited block that directs the agent to send specific identity headers with the user's API key. Even if intended for package compatibility, burying such instructions in skill text makes the behavior less auditable and increases the chance of silent metadata leakage or policy bypass in multi-skill environments.

Content

Scanner excerpt · references/api-search.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 93% confidence

Finding

This duplicate hidden-instructions finding reflects the same issue: covert directives at the top of the document instruct the agent to reuse configured API keys and attach specific package/source identifiers. Because such instructions are embedded outside normal user-visible flow, they increase the risk of stealthy credential use and deceptive request attribution.

Content

Scanner excerpt · references/auto-register.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 93% confidence

Finding

This duplicate hidden-instructions finding reflects the same issue: covert directives at the top of the document instruct the agent to reuse configured API keys and attach specific package/source identifiers. Because such instructions are embedded outside normal user-visible flow, they increase the risk of stealthy credential use and deceptive request attribution.

Content

Scanner excerpt · references/auto-register.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill embeds a full account lifecycle workflow—automatic registration, device-feature collection, API key issuance/storage, balance checks, update-acknowledgement, and recharge/login flows—that materially exceeds the declared purpose of bid-data querying and analytics. This creates unnecessary access to local state and user identity/account management paths, increasing privacy and security risk without being required for the advertised functionality.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill instructs the agent to inspect local environment/config sources for credentials and to collect device identifiers such as OS, CPU architecture, and a MAC-derived hash, then transmit them to a remote service. Even with hashing and stated consent text, this is unrelated to tender analysis and constitutes unnecessary collection of local sensitive metadata and credential discovery behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Line L003 states the skill '必须以图表或Markdown表格形式输出' and the surrounding description is entirely in Chinese, effectively forcing a specific presentation style and language context whenever the skill is invoked. The policy only allows locale constraints when the user is given a choice or the constraint is clearly justified; no user opt-in or alternative is provided here.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs use of WebSearch and broader internet sources beyond the stated tender/bid data platform. That expands the tool's data access and trust boundary unnecessarily, increasing the risk of exfiltration to third parties, ingestion of unreliable data, or privacy issues when user queries or retrieved entities are sent outside the core API.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill goes beyond data querying into product promotion, routing to other skills, and directing users to an external agent/service. This broadens the operational scope from information retrieval to cross-service traffic shaping, which can create phishing-like trust confusion, unexpected data sharing, and pressure to leave the intended tool context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file introduces account-management and upgrade-notice workflows that go beyond the skill’s stated bid-data radar purpose. Expanding a skill’s scope to include unrelated authenticated account operations increases attack surface and can enable unnecessary access to billing, usage, and package-state data under the same API key.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documented ability to acknowledge upgrade reminders (display_ack / confirm_skill_update_display) allows the skill to mutate remote account/package state without serving the user’s core analytics task. That creates a state-changing side effect which could suppress future notices or alter auditability, especially if triggered automatically during normal conversations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs the agent to automatically expand a user-provided company name into all semantically related entities, including subsidiaries, and proceed without user confirmation. This can broaden the query scope beyond the user's intent, causing unintended data access, inaccurate analysis, and privacy or authorization issues if similarly named but distinct companies are included.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The file’s user-facing directives are written as mandatory behavior, including relaying update notices to the user exactly as returned (原样转达用户). Because the skill content consistently mandates Chinese-language interaction and does not offer any language/locale choice or opt-in, it creates a locale policy concern for users who may expect responses in another language.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation injects mandatory workflow steps unrelated to the core bidding-search function: a session-start account balance/version-check call and a follow-up acknowledgement call. This expands data sharing and tool behavior beyond the user's requested task, causing authenticated account metadata and session usage signals to be transmitted before the primary action, which is a form of over-privileged/hidden side effect.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.