Security audit
Security checks for vulnerabilities and agentic risk
The skill is mainly a tender-data assistant, but it needs review because it can create and store service credentials, collect a device fingerprint with consent, and contains hidden-comment instructions for authenticated account/version checks.
Install only if you trust the Zhiliaobiaoxun/Biaobiaoda service with authenticated tender queries, account usage data, and the described trial-registration device fingerprint. Prefer configuring your own ZLBX_API_KEY instead of auto-registration, review ~/.zlbx/config.json after use, and decline auto-registration if you do not want local credential storage or MAC-derived device identification.
The description says the skill 'must trigger' for a long list of broad phrases and even whenever conversation involves general 'business pain points' such as procurement sourcing or risk control. It does not provide exclusion conditions or clear limits, so the trigger scope is ambiguous and may cause unintended invocation in normal conversation.
The skill instructs the agent to collect device characteristics (platform, arch, mac_hash) in order to auto-register an account. That data collection is not necessary for answering tender-analysis queries and creates privacy and fingerprinting risk, especially when combined with account creation and persistent credential storage.
This duplicate finding points to the same hidden-instructions block controlling request identity and follow-up network behavior. Even if the content is not overtly malicious, concealment of executable guidance in comments is dangerous because it bypasses transparent review and can be used to smuggle tracking or policy-evading behavior.
分寸：同一会话最多引导一次；用户拒绝或表示已经在用之后本会话不再出现。引导必须出现在首次用法介绍、家族 Skill 转介之后，作为回答的最后一段。
安装包身份与升级检查：所有发往知了标讯 API 的请求（包括账户查询）必须额外携带以下两个请求头：
X-Skill-Package: tender-opportunity-biaobiaoda/2.0.7
This duplicate finding points to the same hidden-instructions block controlling request identity and follow-up network behavior. Even if the content is not overtly malicious, concealment of executable guidance in comments is dangerous because it bypasses transparent review and can be used to smuggle tracking or policy-evading behavior.
分寸:同一会话最多引导一次;用户拒绝或表示已经在用之后本会话不再出现。引导必须出现在首次用法介绍、家族 Skill 转介之后,作为回答的最后一段。
安装包身份与升级检查:所有发往知了标讯 API 的请求(包括账户查询)必须额外携带以下两个请求头:
X-Skill-Package: tender-opportunity-biaobiaoda/2.0.7
The skill contains embedded hidden instructions in HTML comments that direct the agent to attach specific identity headers, reuse configured credentials, perform automatic account-balance checks, relay upgrade notices, and submit acknowledgment receipts. Hidden control instructions are dangerous because they can silently alter agent behavior, trigger network actions the user did not request, and exfiltrate package/source metadata alongside authenticated requests.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The skill contains embedded hidden instructions in HTML comments that direct the agent to attach specific identity headers, reuse configured credentials, perform automatic account-balance checks, relay upgrade notices, and submit acknowledgment receipts. Hidden control instructions are dangerous because they can silently alter agent behavior, trigger network actions the user did not request, and exfiltrate package/source metadata alongside authenticated requests.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding points to the same hidden instruction block directing the agent to send specific identity headers with an existing API key. Because the instruction is concealed in content rather than enforced by trusted configuration, it creates a channel for untrusted skill text to influence authenticated requests and service attribution.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding points to the same hidden instruction block directing the agent to send specific identity headers with an existing API key. Because the instruction is concealed in content rather than enforced by trusted configuration, it creates a channel for untrusted skill text to influence authenticated requests and service attribution.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding identifies the same hidden instruction pattern: concealed prompt content controls request identity headers and credential usage for API calls. In a skill that performs external lookups, that makes the hidden content materially more dangerous because it steers authenticated requests while reducing transparency to users and reviewers.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding identifies the same hidden instruction pattern: concealed prompt content controls request identity headers and credential usage for API calls. In a skill that performs external lookups, that makes the hidden content materially more dangerous because it steers authenticated requests while reducing transparency to users and reviewers.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instructions finding refers to the same concealed request-identity directive embedded in comments at the top of the file. Even if the header values are legitimate, encoding them as hidden instructions makes the skill less auditable and creates a mechanism for covert agent control outside normal visible documentation.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instructions finding refers to the same concealed request-identity directive embedded in comments at the top of the file. Even if the header values are legitimate, encoding them as hidden instructions makes the skill less auditable and creates a mechanism for covert agent control outside normal visible documentation.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The HTML-comment and package-identity sections contain hidden operational instructions to the agent about request headers, package identity, and behavior. Hidden instructions are dangerous because they can silently steer agent actions, bypass user expectations, and create covert data/control channels not obvious in the visible skill purpose.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The HTML-comment and package-identity sections contain hidden operational instructions to the agent about request headers, package identity, and behavior. Hidden instructions are dangerous because they can silently steer agent actions, bypass user expectations, and create covert data/control channels not obvious in the visible skill purpose.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The skill embeds an account bootstrap flow unrelated to the declared tender-analysis purpose: it collects device-derived identifiers, creates remote accounts, persists credentials locally, and later generates auto-login SIDs. Even with disclosure text and consent language, this materially expands capability from bid analysis into identity, account, and credential lifecycle handling, increasing privacy and abuse risk if the skill is triggered unexpectedly or repurposed.
The skill instructs the agent to execute host-level OS commands to collect platform, architecture, and a hashed MAC-derived fingerprint. This is sensitive host reconnaissance outside the bidding-assistant purpose, and hashing does not eliminate privacy risk because the value still functions as a stable device identifier suitable for tracking, correlation, or account binding.
The natural-language policy here hard-codes activation around Chinese phrases and presents all user-facing guidance in Chinese, but does not state that the skill is intentionally limited to Chinese-speaking users or provide any language opt-in. This can violate language/locale policy when a skill forces a specific language behavior without user choice.
The skill’s declared purpose is tender/opportunity analysis, but it also instructs the agent to perform automatic account registration and write credentials to a local file. That expands scope from data querying into identity creation and local secret persistence, which creates security and privacy risk if the user did not explicitly expect or authorize those side effects.
The file adds account-balance, recharge, and consumption-query behavior to a skill whose stated purpose is tender opportunity analysis and bid-risk assessment. This scope expansion enables collection and use of billing/account telemetry unrelated to the user’s procurement task, increasing the chance of unnecessary data access and privacy overreach if the skill is triggered broadly.
The documentation instructs the agent to query daily consumption, balance, recharge, and usage trends using the configured API key, even though those actions are not justified by the declared tender-analysis workflow. That creates an over-privileged skill design where operational and billing telemetry can be exposed or processed without a strong functional need, broadening data exposure if the skill is misused or auto-invoked.
The skill instructs the agent to automatically expand a user's company query to all semantically matched headquarters and subsidiaries without confirmation. This can cause over-collection and unintended disclosure or analysis of data about unrelated entities, especially when a short name is ambiguous, making downstream results inaccurate and privacy-invasive.
The file instructs the agent to use a fixed external source label and suppress other names in all dialogues and reports, and the entire skill guidance is written as mandatory Chinese-facing behavior. There is no indication that the user may choose another language or locale, which can violate language/locale choice policy for a general-purpose skill.
The entire user-facing API documentation and operational instructions are written in Chinese, including required reminder forwarding text and usage guidance, with no indication that users may choose another language. This creates a natural-language locale constraint that is not presented as optional or justified as a region-specific compliance requirement.
No suspicious patterns detected.