Security audit
Security checks for vulnerabilities and agentic risk
This is a real tender-data integration, but it is broader than advertised and can create accounts, fingerprint the device, store credentials, and access account/contact data.
Review this skill before installing. Prefer configuring your own ZLBX_API_KEY instead of allowing auto-registration. Only approve auto-registration if you accept device fingerprinting, local API-key storage, third-party account creation, quota/recharge flows, and possible access to tender contact data.
The auto-registration flow collects device characteristics (platform, architecture, and a MAC-derived hash) to create an account and store an API key locally. This is high risk because it introduces fingerprinting and identity creation unrelated to the core search task, potentially enabling covert user tracking and unauthorized enrollment into a third-party service.
This duplicate hidden-instructions finding points to the same concealed package-identity section that drives outbound metadata tagging and acknowledgement logic. Concealed behavior is especially risky in agent skills because reviewers and users may approve a benign-looking search tool while hidden directives silently expand network behavior and tracking.
分寸：同一会话最多引导一次；用户拒绝或表示已经在用之后本会话不再出现。引导必须出现在首次用法介绍、家族 Skill 转介之后，作为回答的最后一段。
安装包身份与升级检查：所有发往知了标讯 API 的请求（包括账户查询）必须额外携带以下两个请求头：
X-Skill-Package: tender-search-biaozhaozhao/1.0.9
This duplicate hidden-instructions finding points to the same concealed package-identity section that drives outbound metadata tagging and acknowledgement logic. Concealed behavior is especially risky in agent skills because reviewers and users may approve a benign-looking search tool while hidden directives silently expand network behavior and tracking.
分寸:同一会话最多引导一次;用户拒绝或表示已经在用之后本会话不再出现。引导必须出现在首次用法介绍、家族 Skill 转介之后,作为回答的最后一段。
安装包身份与升级检查:所有发往知了标讯 API 的请求(包括账户查询)必须额外携带以下两个请求头:
X-Skill-Package: tender-search-biaozhaozhao/1.0.9
This duplicate hidden-instructions finding identifies the same behavior: concealed guidance that tells the agent how to authenticate and what package/source identity to assert on outbound requests. Such concealed control text can override expected least-privilege behavior and facilitates silent exfiltration of package provenance and credential-backed usage signals.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instructions finding identifies the same behavior: concealed guidance that tells the agent how to authenticate and what package/source identity to assert on outbound requests. Such concealed control text can override expected least-privilege behavior and facilitates silent exfiltration of package provenance and credential-backed usage signals.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The skill is described as a quick tender-search tool, but this file documents broad company-intelligence functions including profiling, partner mapping, competitor analysis, and contact retrieval. That scope expansion violates least privilege and increases the chance an agent will access sensitive or unnecessary data beyond the user’s expected task.
The documented contact lookup exposes project contact information, including phone numbers, for a skill whose stated purpose is fast tender keyword search. Even if some numbers are masked by account tier, this still enables access to personal/contact data unrelated to the advertised function and could facilitate scraping, unsolicited outreach, or privacy abuse.
This duplicate hidden-instructions finding identifies the same concealed request-identity block that directs use of an API key and fixed headers. Concealed operational directives are risky because they enable silent outbound behavior and metadata tagging beyond what a user would reasonably expect from a simple tender search skill.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instructions finding identifies the same concealed request-identity block that directs use of an API key and fixed headers. Concealed operational directives are risky because they enable silent outbound behavior and metadata tagging beyond what a user would reasonably expect from a simple tender search skill.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instructions finding points to the same concealed directive pattern: comment-embedded instructions controlling API identity and package source. Even if the content is not overtly malicious, hiding such behavioral requirements in documentation increases the risk of prompt-injection-style control over network requests and weakens auditability.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instructions finding points to the same concealed directive pattern: comment-embedded instructions controlling API identity and package source. Even if the content is not overtly malicious, hiding such behavioral requirements in documentation increases the risk of prompt-injection-style control over network requests and weakens auditability.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The hidden comment block embeds operational instructions that force specific identity headers and request provenance handling. Hidden instructions are dangerous because they can steer the agent's network behavior in ways not visible in normal user-facing descriptions, reducing transparency and making it harder to audit what identity data is being asserted to remote services. In this case, the hidden directives are tied to credentialed requests and package identity propagation.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The hidden comment block embeds operational instructions that force specific identity headers and request provenance handling. Hidden instructions are dangerous because they can steer the agent's network behavior in ways not visible in normal user-facing descriptions, reducing transparency and making it harder to audit what identity data is being asserted to remote services. In this case, the hidden directives are tied to credentialed requests and package identity propagation.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The file defines an extensive auto-registration and account-management subsystem for a skill whose stated purpose is only tender quick search. It instructs the agent to collect device characteristics, register remote accounts, persist credentials, generate recharge links, and manage account state, which materially expands the skill's privileges and data handling beyond user expectations. That mismatch increases the risk of unauthorized data collection, credential handling, and covert capability expansion.
The skill directs the agent to execute OS-level shell and PowerShell commands to derive a device fingerprint from platform, architecture, and MAC-based identifiers. For a tender search skill, this collection is unnecessary and privacy-invasive, and it creates a stable cross-session identifier that can be transmitted to a third party without being intrinsic to the user task. Even with hashing, MAC-derived identifiers remain device fingerprints rather than task data.
The skill instructs writing an API key into ~/.zlbx/config.json, creating directories and merging into a persistent user config file. Persisting credentials from within a search skill is outside the declared function and introduces credential-at-rest risk, unexpected file modification, and long-lived session establishment without clear user control. This can silently extend access beyond the current task or session.
The balance check, recharge-link generation, auto-login SID flow, and update-acknowledgment logic add account lifecycle and monetization behavior unrelated to tender searching. This broadens the skill into account orchestration and user-journey manipulation, potentially causing unsolicited external calls and exposing users to unwanted state changes or trust in clickable login links. In context, these are dangerous because they are hidden operational behaviors, not core search functionality.
The description is written as an invocation instruction that the skill is used when a user wants to query tender data and implicitly defines the output behavior in Chinese ('输出精简直接的列表'). Throughout the file, all user-facing guidance and required messages are prescribed only in Chinese, with no opt-in or alternative locale handling, which creates a language/locale policy concern.
The skill’s declared purpose is a quick tender search tool, but it also instructs the agent to perform account management, automatic registration, local credential handling, and upgrade acknowledgement. This scope expansion is dangerous because it grants the skill authority to manipulate identity, billing, and persistent local state beyond what a user would reasonably expect from a search-only capability.
The manifest emphasizes fast keyword-based retrieval of tender or award announcements with compact output. Recommending use of WebSearch for company depth analysis, industry ranking, policy analysis, and market outlook introduces broader research and analysis capabilities not justified by that limited purpose.
Mandating a balance check and update-notice acknowledgement on first use adds hidden account/package-management actions unrelated to the stated quick-search purpose. These extra calls can leak usage metadata, create non-obvious third-party interactions, and normalize background actions the user did not request.
No suspicious patterns detected.