招标中标查询&数据分析-乙方投标助手

• Outcome: Review
• Latest audit: Aug 14, 2026 · 12:12 PM UTC
• Version: 2.0.1

Overview

The skill mostly supports tender research, but it also includes under-disclosed account setup that fingerprints the device and stores a service key, plus contact lookup, so users should review it before installation.

Review before installing. Prefer configuring your own ZLBX_API_KEY manually if you do not want the auto-registration flow to collect a hashed MAC/device profile or write ~/.zlbx/config.json. Treat contact lookups as sensitive business or personal data, avoid bulk extraction or unsolicited outreach, and protect or remove the local config file if the key should not persist.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The documented `get_company_contacts` capability enables retrieval and display of identifiable project contact information, including phone numbers, which goes beyond high-level tender analysis into direct personal/contact data exposure. Even though the docs mention masking for some account tiers, the skill still operationalizes access to contact details and could facilitate privacy violations, unsolicited outreach, or data harvesting if invoked without strong purpose and consent controls.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This document instructs the agent to perform account provisioning, collect device-derived identifiers, transmit them to a remote service, and persist returned credentials locally. Those behaviors exceed the stated tender-analysis purpose and create a materially broader trust boundary, enabling user tracking, silent account creation, and durable credential handling in a skill that users would not reasonably expect to manage identity state.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill directs collection of platform, CPU architecture, and a hashed MAC address for trial deduplication, which is still a stable device fingerprint even if the raw MAC is not sent. In the context of a bid-analysis assistant, this collection is unrelated to core functionality and enables tracking/correlation of a user's device across sessions and accounts.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill persists API keys to a local config file and manages post-registration account lifecycle actions such as generating auto-login links and recharge flows. This is unrelated to tender analysis and increases the blast radius of compromise by leaving long-lived credentials on disk and teaching the agent to manage authentication state without a dedicated secret-management mechanism.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly exposes a `get_company_contacts` capability but provides no user warning, consent gate, or usage constraint for retrieving contact information, which may include personal data. In a procurement-intelligence context this increases the risk of unnecessary collection, disclosure, or downstream misuse of individuals' contact details.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation instructs the agent to automatically include all semantically matched headquarters and branch entities without user confirmation, which can silently broaden the scope of analysis beyond the user's intended target. This creates a data minimization and accuracy risk: the system may aggregate unrelated affiliates, produce misleading conclusions, or query additional entities the user did not mean to investigate.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The contact-information feature documents exposure of named contacts and phone numbers with only a monetization note about masked vs. full access, but lacks a meaningful privacy, lawful-use, or consent warning. In a tender-analysis skill, this makes personal/business contact data too easy to surface and normalize for outreach or profiling beyond the core analytical purpose.

External Transmission

Medium

• Category: Data Exfiltration

Content

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>

• Confidence: 90% confidence
• Finding: requests.post(url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.