招投标商机监控雷达-标标达

• Outcome: Review
• Latest audit: Aug 14, 2026 · 12:21 PM UTC
• Version: 2.0.1

Overview

The skill’s procurement analysis features fit its purpose, but it also includes an under-disclosed trial signup flow that collects a stable device fingerprint, sends it to a third party, and saves an API key locally.

Install only if you are comfortable with this provider receiving your procurement queries and, if you do not configure an API key yourself, with the skill asking to create a trial account using your OS, CPU architecture, and a hashed MAC-derived device identifier. Prefer configuring ZLBX_API_KEY manually and review/remove ~/.zlbx/config.json if you do not want a persistent local key.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The document defines a full auto-registration, device-fingerprinting, credential storage, and recharge/login workflow that materially exceeds the declared tender-analysis purpose of the skill. Even though it asks for consent and limits fields, it still instructs the agent to collect host-derived identifiers and create persistent third-party accounts, which broadens the trust boundary and creates privacy, compliance, and abuse risk unrelated to core bidding analysis.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill directs collection of platform, architecture, and a hashed MAC-derived identifier and sends them to an external service to create trial accounts. A hashed MAC is still a stable device fingerprint, and in this context the capability is not justified by the advertised tender-monitoring function, making the skill more dangerous because users would not reasonably expect endpoint fingerprinting from a bidding-analysis assistant.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Persisting API keys to ~/.zlbx/config.json creates a long-lived credential footprint on the local system for a skill whose stated purpose is analysis rather than account management. This increases exposure if the filesystem is shared, backed up, or readable by other local processes, and the persistence is automatic rather than clearly user-directed.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The auto-login and recharge flow extends the skill into account lifecycle and monetization handling unrelated to tender analysis. Generating login links tied to an API key can create phishing-like UX, increase the blast radius of compromised local credentials, and normalize external account actions that users did not request from an analysis skill.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The skill description mandates invocation for very broad, loosely defined bidding and procurement topics, which can cause the agent to over-route user requests to this external service without clear necessity or informed user intent. That increases the chance of unnecessary disclosure of sensitive business queries, vendor names, project interests, and procurement strategy to a third-party API.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The tool list includes a company contacts lookup capability, but the skill does not warn users that it may retrieve and expose personal or business contact information. In a procurement intelligence context, surfacing contact data without notice or policy constraints can enable privacy violations, unwanted outreach, or misuse of personal data.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documented behavior expands a user’s query from one named company to multiple related entities and proceeds with downstream analysis without explicit confirmation. In a bid-risk and company-intelligence context, this can materially change scope, mix unrelated subsidiaries into results, and mislead users into making commercial or compliance decisions based on over-broadened data.

External Transmission

Medium

• Category: Data Exfiltration

Content

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>

• Confidence: 86% confidence
• Finding: This section explicitly instructs the agent to transmit collected device features to an external endpoint. External transmission is expected for a cloud-backed service, but here it is risky because the transmitted data includes a stable device-derived fingerprint and occurs in support of an undeclared auto-registration capability rather than the core tender-analysis task.

External Transmission

Medium

• Category: Data Exfiltration

Content

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>
> 历史教训：曾有版本采集 `home_path`，Windows 的 `C:\Users\alice` 直接拼进 JSON 字符串时

• Confidence: 80% confidence
• Finding: The mention of curl -d @file is not dangerous because of curl itself, but because it is part of the same instruction set for sending registration data to an external service. The security issue is the external transmission of device-derived information in a workflow outside the stated skill purpose, not the serialization guidance alone.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.