热门标讯挖掘助手-火标网

• Outcome: Review
• Latest audit: Oct 13, 2026 · 2:18 AM UTC
• Version: 2.1.6

Overview

This tender-search skill is not clearly malicious, but it deserves review because it can create an account, send a MAC-derived device identifier, store an API key locally, and access broader company/contact data than its short description suggests.

Install only if you are comfortable with a China-focused tender data skill that may, after consent, send a hashed device identifier to create a trial account and store an API key under ~/.zlbx/config.json. Prefer configuring your own ZLBX_API_KEY if you do not want auto-registration, and review contact lookup and company-expansion behavior before using it for sensitive business research.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs automatic registration and collection of device features (platform, architecture, MAC-derived hash) when no key is present, even though this is not necessary for the core tender-analysis task. Collecting device identifiers and creating external accounts materially expands privacy and security risk, especially because it persists credentials locally for future use.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document defines a full auto-registration, key issuance, local credential storage, and recharge flow for a skill whose declared purpose is tender analytics. This materially expands the skill’s behavior into account provisioning and persistent auth management, creating unnecessary security and privacy risk far beyond the user-expected analytics function.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs collection of platform, CPU architecture, and a hashed MAC-derived identifier to support device-based account creation and deduplication. Even with hashing, this is still device fingerprinting and is not necessary for performing tender-mining analytics, making the data collection disproportionate to the stated purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file implements account recovery handling, quota exhaustion logic, SID generation, auto-login link delivery, and recharge guidance, none of which are required for tender analytics. Embedding account-management and monetization flows into a data-analysis skill increases attack surface, encourages persistent session handling, and normalizes off-purpose credential actions inside the agent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as a tender-trend mining assistant, but its documented behavior includes account handling and API-key acquisition workflows. This scope expansion can surprise users and cause the agent to perform credential-related actions that are not reasonably implied by the advertised purpose, increasing the risk of unintended secret handling and consent bypass.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The declared use case is market heat analysis, but the skill exposes much broader capabilities such as company intelligence, contact lookup, pricing, project tracking, and opportunity discovery. This mismatch weakens user understanding of what the agent may do and increases the chance of collecting or exposing more business-sensitive data than expected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file is written entirely in Chinese and repeatedly specifies exact Chinese phrasing to present to users, such as fixed Chinese guidance and disclosure text. There is no indication that the skill should detect or honor the user's preferred language, which can violate language/locale choice policies.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation contains conflicting rules: one section limits auto-registration to cases with no existing key, while the error-handling section tells the agent to re-register even when a key exists but fails. Such inconsistency can trigger unnecessary account creation, overwrite expected authentication state, and lead to credential confusion or accidental use of the wrong account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation instructs the agent to automatically expand a user's company query to include headquarters and subsidiaries, then run follow-on analysis without user confirmation. This can silently broaden the dataset and analysis target beyond what the user explicitly named, causing over-collection, inaccurate attribution, or unintended exposure of affiliated entities' procurement data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file documents multiple company-intelligence functions—profiling, partner analysis, competitor analysis, contacts, and supplier recommendation—that materially exceed the manifest's stated scope of trending tender mining and aggregation. This scope expansion increases the chance of undisclosed data use, privacy issues, and operator misuse because users may invoke capabilities they were not led to expect from the skill description.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented get_company_contacts capability exposes project contact information, including phone numbers, that goes beyond the skill's stated purpose of tender-trend aggregation and market heat analysis. Even if some numbers are masked for lower-tier accounts, the feature enables targeted contact discovery and creates unnecessary privacy and data-mining risk when embedded in a broader analytics skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documented API surface is materially broader than the skill’s stated purpose of hotness/concentration trend analysis, including generic search, detail retrieval, project timelines, expiring projects, and proposed-project discovery. This kind of scope drift can enable data access and workflows not expected by users or reviewers, weakening least-privilege boundaries and making misuse or prompt-induced overreach more likely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file presents all user-facing instructions and API details only in Chinese. The content does not indicate that the skill is intentionally limited to Chinese-speaking users or provide any user opt-in or language alternative, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Full bid detail and especially fulltext retrieval exceed what is needed for aggregate market-trend analysis and introduce access to substantially richer raw content. That increases the risk of unnecessary data exposure, downstream prompt injection from fetched text, and repurposing the skill for targeted document extraction rather than high-level analytics.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

Lines L029-L030 state that when a user has proactively configured a key, the skill should not output any automatic registration, automatic login, or phone-binding guidance. Later, L215 instructs that if the current key comes from the environment variable, the agent should direct the user to manually log in and recharge, which conflicts with the earlier instruction not to present such guidance for proactively configured keys.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The document explicitly instructs sending collected device features to an external service for automatic account registration. This is a real external transmission of host-derived data and should be treated as sensitive because it exports persistent device-linked identifiers to a third party.

Content

Scanner excerpt · references/auto-register.md (reported line 121)May include surrounding context.

md

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The alternate curl -d @file guidance describes the same outbound registration flow and confirms multiple implementation paths for exporting collected data externally. The risk is not the serialization method itself but the sanctioned transmission of device-linked registration data to a remote endpoint from inside the skill.

Content

Scanner excerpt · references/auto-register.md (reported line 122)May include surrounding context.

md

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>
> 历史教训：曾有版本采集 `home_path`，Windows 的 `C:\Users\alice` 直接拼进 JSON 字符串时

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

This duplicate finding points to the same credential persistence behavior: creating ~/.zlbx, merging config, storing source: auto, and activating the key immediately. That behavior establishes durable session state and credential provenance tracking inside a non-auth skill, which broadens impact if the key or config file is later exposed.

Content

Scanner excerpt · references/auto-register.md (reported line 186)May include surrounding context.

text

注意事项：
- 目录不存在时先 `mkdir -p ~/.zlbx`
- 文件已存在时**合并而非覆盖**（保留用户可能的其他配置）
- `source: "auto"` 字段必须写入，**这是后续判断「是否输出自动登录链接」的关键依据**

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

This duplicate finding points to the same credential persistence behavior: creating ~/.zlbx, merging config, storing source: auto, and activating the key immediately. That behavior establishes durable session state and credential provenance tracking inside a non-auth skill, which broadens impact if the key or config file is later exposed.

Content

Scanner excerpt · references/auto-register.md (reported line 186)May include surrounding context.

text

注意事项:
- 目录不存在时先 `mkdir -p ~/.zlbx`
- 文件已存在时**合并而非覆盖**(保留用户可能的其他配置)
- `source: "auto"` 字段必须写入,**这是后续判断「是否输出自动登录链接」的关键依据**

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest frames the skill as using multidimensional aggregation interfaces to present tender-market heat and concentration trends. The documentation then advises combining results with general internet search for company strategy, news, policy impacts, and industry rankings, which is a broader research capability not justified by the stated purpose. This changes the skill from bid-data analytics into mixed-source intelligence gathering.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

All headings, instructions, examples, and usage rules are presented only in Chinese, which effectively forces a specific language for users of the skill documentation. The file does not indicate that this is a region-specific or Chinese-only skill, nor does it offer an alternative language or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

该 markdown 文档从标题到全部说明均仅以中文呈现，未说明这是面向特定中文用户群体的区域性文档，也未提供其他语言或用户选择。根据语言/locale 政策，若技能内容隐含强制单一语言而无用户选择或明确合理性说明，可构成自然语言层面的政策问题。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.