地方标讯极速检索-比地招标

• Outcome: Review
• Latest audit: Oct 14, 2026 · 11:18 PM UTC
• Version: 2.0.7

Overview

This skill needs review because it is presented as local tender search but also enables broader business-intelligence queries, contact lookup, and consent-gated device-based account registration with local API-key storage.

Install only if you are comfortable giving this skill access to a bid-intelligence API account that can run broad company, contact, and market-analysis queries. To avoid device-based auto-registration, configure ZLBX_API_KEY yourself before first use, and be aware that the fallback registration path stores an API key under ~/.zlbx/config.json.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (48)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill instructs automatic account registration using device fingerprints and persistence of the returned API key to a local config file. Even with a consent step described in text, this behavior collects host-identifying data and creates or stores credentials on disk, which is far beyond what is necessary for local tender search and can expose privacy-sensitive data and long-lived secrets.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 91% confidence

Finding

This duplicate finding identifies the same hidden instruction block that embeds package identity headers and update-ack logic in an HTML comment. Because the behavior is concealed rather than declared transparently, it increases the chance of unnoticed metadata transmission and hard-to-audit runtime behavior.

Content

Scanner excerpt · SKILL.md (reported line 537)May include surrounding context.

分寸：同一会话最多引导一次；用户拒绝或表示已经在用之后本会话不再出现。引导必须出现在首次用法介绍、家族 Skill 转介之后，作为回答的最后一段。

安装包身份与升级检查：所有发往知了标讯 API 的请求（包括账户查询）必须额外携带以下两个请求头：

text

X-Skill-Package: tender-express-search-bidizhaobiao/2.0.7

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 91% confidence

Finding

This duplicate finding identifies the same hidden instruction block that embeds package identity headers and update-ack logic in an HTML comment. Because the behavior is concealed rather than declared transparently, it increases the chance of unnoticed metadata transmission and hard-to-audit runtime behavior.

Content

Scanner excerpt · SKILL.md (reported line 537)May include surrounding context.

分寸:同一会话最多引导一次;用户拒绝或表示已经在用之后本会话不再出现。引导必须出现在首次用法介绍、家族 Skill 转介之后,作为回答的最后一段。

安装包身份与升级检查:所有发往知了标讯 API 的请求(包括账户查询)必须额外携带以下两个请求头:

text

X-Skill-Package: tender-express-search-bidizhaobiao/2.0.7

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 89% confidence

Finding

This duplicate hidden-instruction finding points to the same covert identity and request-handling directives embedded in comments at the top of the file. Even if not overtly malicious, such hidden instructions increase the chance of policy bypass, unintended data disclosure, and reviewer confusion because the agent may obey metadata that is easy to overlook.

Content

Scanner excerpt · references/api-account.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 89% confidence

Finding

This duplicate hidden-instruction finding points to the same covert identity and request-handling directives embedded in comments at the top of the file. Even if not overtly malicious, such hidden instructions increase the chance of policy bypass, unintended data disclosure, and reviewer confusion because the agent may obey metadata that is easy to overlook.

Content

Scanner excerpt · references/api-account.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is advertised as a local tender express search tool focused on geographically filtered procurement notices, but this reference file exposes broad company-analysis functions far beyond that purpose. This kind of scope expansion increases the attack surface and enables collection or inference of unrelated corporate intelligence, making it easier for the skill to overreach user intent or exfiltrate more sensitive business data than necessary.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file grants access to company project contacts, including phone numbers, despite the skill's stated purpose being local tender search. Access to contact data is especially sensitive because it enables targeted outreach, deanonymization, or bulk lead harvesting unrelated to the user-requested tender lookup, and the mismatch in scope makes misuse more likely.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 97% confidence

Finding

This duplicated hidden-instructions finding points to the same concealed directive to preserve X-Client and add package/source identity headers with the configured API key. In context, concealed request-shaping logic is particularly risky because the skill already exhibits scope mismatch, making hidden outbound-auth behavior more suspicious and less justifiable.

Content

Scanner excerpt · references/api-market.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 97% confidence

Finding

This duplicated hidden-instructions finding points to the same concealed directive to preserve X-Client and add package/source identity headers with the configured API key. In context, concealed request-shaping logic is particularly risky because the skill already exhibits scope mismatch, making hidden outbound-auth behavior more suspicious and less justifiable.

Content

Scanner excerpt · references/api-market.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documented API surface is for market-analysis and statistical tooling, which materially exceeds the skill's declared purpose of local tender notice retrieval with strict geographic filtering and time-sorted results. This scope mismatch can enable unauthorized data enrichment and broader external data access than users or platform reviewers would reasonably expect from the manifest.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Top purchaser and top supplier analytics support customer intelligence and competitive analysis rather than narrow retrieval of local procurement notices. In this skill context, that overbroad capability increases the risk of function creep, misuse of configured credentials, and deceptive packaging that hides the true data-access scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Brand-share, aggregation, and historical price-trend analysis are outside the stated purpose of local announcement search and materially broaden what operators can do with the connected API. Because the skill is presented as a geographically filtered tender search tool, this hidden expansion of analytical capability is security-relevant and can bypass least-privilege expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file’s documented behavior materially exceeds the skill’s declared purpose of region-filtered local tender search and instead exposes broad company-registry, shareholder, investment, change-record, and related enterprise-intelligence functions. This scope drift is dangerous because it enables unnecessary collection and disclosure of business intelligence under the cover of a narrower skill, undermining least-privilege and increasing the risk of misuse or unauthorized data access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The company-registry, shareholder, branch, investment, and change-history APIs are unrelated to the advertised purpose of searching local procurement notices by geography. This overbroad access increases the blast radius of the skill, allowing profiling and corporate due-diligence queries that users may not expect and that are unnecessary for the declared workflow.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-company.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-registry.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-search.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-company.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-registry.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-search.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document contains contradictory amount-unit guidance for query_bids_advanced, with one section stating min_amount/max_amount use 万元 and another claiming query_bids_advanced uses 元. In a procurement search skill, this can silently widen or narrow budget filters by a factor of 10,000, causing materially incorrect results, missed opportunities, or disclosure of data outside the user’s intended scope.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 91% confidence

Finding

This duplicated hidden-instructions finding points to the same covert request-identity directive embedded in comments. In context, the issue is real because it attempts to control auth/header behavior through adversarially consumable documentation rather than a trusted configuration channel.

Content

Scanner excerpt · references/auto-register.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 91% confidence

Finding

This duplicated hidden-instructions finding points to the same covert request-identity directive embedded in comments. In context, the issue is real because it attempts to control auth/header behavior through adversarially consumable documentation rather than a trusted configuration channel.

Content

Scanner excerpt · references/auto-register.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file instructs the agent to perform account provisioning, collect device-derived identifiers, persist credentials, and generate recharge/login flows that are materially unrelated to the skill’s stated purpose of regional tender search. This expands the skill’s authority into identity, persistence, and billing domains, increasing the chance of unauthorized data handling and abuse if the agent follows the instructions automatically.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation directs collection of platform, architecture, and a MAC-derived hash for device fingerprinting, then transmission to a remote registration endpoint. Even with hashing and stated consent language, this is not necessary for tender search and creates privacy and tracking risk, especially because it instructs host-level probing commands and uses a semi-stable hardware identifier.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.