Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to support IT bid analysis, but it also handles account registration, device-derived identifiers, local API-key storage, and report file creation, so users should review it before installing.
Install only if you are comfortable with a third-party bid-data service receiving project/company queries, charging API credits, optionally registering a trial account using a hashed device identifier, and storing an API key in ~/.zlbx/config.json. Prefer setting your own ZLBX_API_KEY if you do not want auto-registration or local key persistence.
声明描述的是一个面向用户的“投标决策分析助手”，核心价值应是分析与判断；而给出的代码文件是 render_report.py，一个纯展示层工具。它接受已经生成好的JSON结果，拼装HTML页面，内嵌品牌logo和CSS，渲染结论、项目画像、采购方分析、竞争格局、报价参考、风险清单、行动建议和引用附录，并支持浏览器打印、导出PDF和前端保存长图。虽然输出页面中的栏目名称与声明的报告内容一致，但代码本身并不产生这些分析结果，只负责呈现已有数据。因此其实际主功能与声明的主功能存在实质偏差：声明是“分析助手”，代码是“报告渲染器”。这属于明显的描述-行为不一致。
The invocation rule is extremely broad and says the skill must be used for many loosely related IT bidding-analysis requests, even when users do not mention the specific domain. Overbroad auto-invocation can cause unnecessary transmission of sensitive business queries to third-party services, unexpected quota spend, and inappropriate tool selection without clear user intent.
Referenced artifact was not completely inspected
完整模式下，对话报告输出后默认再用 `scripts/render_report.py` 生成一份可分享的 HTML 版报告并告知保存路径（详见 report-template.md「HTML 报告导出」）。
Referenced artifact was not completely inspected
完整模式下，对话报告输出后默认再用 `scripts/render_report.py` 生成一份可分享的 HTML 版报告并告知保存路径（详见 report-template.md「HTML 报告导出」）。
This duplicate finding points to the same hidden instruction block controlling request metadata and callback behavior. Even if the content is not overtly malicious, concealing mandatory operational logic in comments reduces auditability and can enable undisclosed tracking or remote state changes.
安装包身份与升级检查：所有发往知了标讯 API 的请求（包括账户查询）必须额外携带以下两个请求头：
X-Skill-Package: xinchuang-it-bid-decision/1.0.7
This duplicate finding points to the same hidden instruction block controlling request metadata and callback behavior. Even if the content is not overtly malicious, concealing mandatory operational logic in comments reduces auditability and can enable undisclosed tracking or remote state changes.
安装包身份与升级检查:所有发往知了标讯 API 的请求(包括账户查询)必须额外携带以下两个请求头:
X-Skill-Package: xinchuang-it-bid-decision/1.0.7
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: bid-decision/1.0.5
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: bid-decision/1.0.5
This duplicated hidden-instruction finding refers to the same concealed request-identity block, which still represents agent-steering content not visible as normal user-facing behavior. Such hidden instructions are especially concerning here because they govern authenticated outbound requests and package identity headers.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: bid-decision/1.0.5
This duplicated hidden-instruction finding refers to the same concealed request-identity block, which still represents agent-steering content not visible as normal user-facing behavior. Such hidden instructions are especially concerning here because they govern authenticated outbound requests and package identity headers.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: bid-decision/1.0.5
This document instructs the agent to perform automatic account registration, collect device-derived identifiers, persist API credentials locally, and manage account/balance flows, which materially exceeds a bid-decision assistant’s declared business purpose. That overreach creates unnecessary access to host and account state and expands the blast radius from content analysis to credentialed external actions on behalf of the user.
The skill directs collection of platform, architecture, and a hashed MAC-based device fingerprint plus local credential handling, even though those capabilities are not necessary to analyze IT tenders. Even with a hashed MAC, this is still persistent device tracking data tied to account provisioning, and combined with local API-key storage it creates privacy and credential-risk exposure disproportionate to the stated task.
This duplicate finding points to the same concealed request-identity instructions at the top of the file. Such hidden directives can manipulate how the agent authenticates and identifies itself to external services, bypassing normal transparency and increasing the risk of unauthorized or misleading outbound requests.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: bid-decision/1.0.5
This duplicate finding points to the same concealed request-identity instructions at the top of the file. Such hidden directives can manipulate how the agent authenticates and identifies itself to external services, bypassing normal transparency and increasing the risk of unauthorized or misleading outbound requests.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: bid-decision/1.0.5
This duplicate hidden-instruction finding points to the same concealed request-identity block that tells the agent how to use API credentials and package headers. In the context of a skill that performs external procurement lookups, concealing such behavior increases the risk of unauthorized or non-transparent data transmission and reduces audibility of security-sensitive actions.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: bid-decision/1.0.5
This duplicate hidden-instruction finding points to the same concealed request-identity block that tells the agent how to use API credentials and package headers. In the context of a skill that performs external procurement lookups, concealing such behavior increases the risk of unauthorized or non-transparent data transmission and reduces audibility of security-sensitive actions.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: bid-decision/1.0.5
Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
THREAT_COLOR = {"高": "#c0392b", "中": "#b9770e", "低": "#0d9463"}
# 知了标讯白色 logo（299x96 PNG base64 内嵌，保证报告离线/打印/转发时不裂图）
_LOGO_B64 = "iVBORw0KGgoAAAANSUhEUgAAASsAAABgCAYAAABFTFSvAAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAABK6ADAAQAAAABAAAAYAAAAACurZhBAAA2V0lEQVR4Ae2dB5xU1fXHzzZ6752ldxHpHTtqTKJJjEmMGkvKP/aIRk0UayzYxZJouokaYyzRiKCAoIB0kN47LB0WFnZh9//9vZmHb4eZnZndmWVW3vl8fjOv3fvuO+++3z3nvHvvM/PF14CvAV8DFUADafbM2OusKOMCKywoqgDlDV/ENIpemJ5vGYW5VmjbrChtlaXZYks7usRuumlb+ET+Vl8DvgYqkgYyzdJ6WqWskXa0IhU7UlnTzLgiK4K8jh7litK22FPPT4O03rb8zAk26hc5kVL6230N+BpIbQ1kWpEdsYJ8Hu4jqV3SeEuXlpZBkhaWmf49s/RvW9aRFfbs2D9ZweF/2i23bIo3O/94XwO+Bk6sBtJP7OmTeHZZV0JBgdmRI1mWnt7V0jIesozK7+H6/shGj66UxLP7Wfsa8DWQYA18fcnKq6iAWxggrbS0XpDWc1a34dP2zDMtvIf5y74GfA2krgZODrJy9e+SVuHROpae8ROC8i/bsy/1cHf7/74GfA2krgZOLrJy70NhoWJ0lXENz8Tces6eHHuqu8v/9zXgayA1NXBykpXuhayswkJeMKQPtHR7greGnVLzFvml8jXga0AaOHnJSlfvENbRLEtLG2BphaPtiSfqabMvvgZ8DaSeBk5ustL9EGEVFVW1jIwzLC3rlyzTWcsXXwO+BlJNAz5Z6Y4ohnXkaCPLSP++PfnCkFS7SX55fA34GjjZ3cDjakBatqUduQZ3sOpxu/wNvgZ8DZxQDfiWlav+gDtY3TKz+plVHupu9v99DfgaSA0N+GTlvQ8Bwmpm6YUX2htvaLiOL74GfA2kiAaST1bEr5Miycq3sLAm5e1jG7e3SUq5/Ux9DfgaKJUGkkNWRxgUfUSTHjAJQjqnKGRZ6wpklyQByybyEZpIQeC4jHQy1/HKV9sSIcovLS0NV7ARhcUd9MXXgK+BVNGAJlRJnEBGVbOy7Lz2be1bbdtax3p1LYtnf1tenk3euMneWrHSVu7cbTCNSAGyUU9yCILV9IxMq5KVaUfZdPioBh9DQDomTXxaZNUyM613s2Z2UYe2dlrDhlaD8+w5nG8zt22zd1atthlbmcZKZChyLKsUFtWxtKJTyOYfZc3KT+9rwNdAYjSQZk8//wKk8POyThGTAfF0b9DQHh022M5p3eq40slr27R/vz06a649N28uYSGzVnXr2vltWtvpLVpY29q1rHqlLDsC4ew8dMjm5+yw91avsbk5260mxHRr3952eZdOVp3lUNHxf1m01B6bNdu25uZChmUINzkEmXYIa+1dGPNKppPJCz2fv+5rwNdA+WsgIZZVBpbPKQ0b2avnn2tdsKaO4E6t3L3bpm/ZagcKjjgW1sAmTaxFzZr20JCB1q1BPQwXw0pqZw2rhu8lMBQr6mendLecgwctl2leOkFsynfdvn32xdYcZ3vzmjWsb+NG1rxGDefYJtWr2k2Tpth20pTJwioqghHTGllWVl1uiU9W5V8v/TP6GjhOAwkhq/pVqth9gwY4RLU3P98enTnHnsd62pN32IkrZeLi9Wve1P5w1unWtX59+1mP7scVJNyGLFw6EZGkEKKat32H3Txxkk1du94ho0xcQ+V3W7/e9oNOHe2c7NZ2Q699ds/n05nduJTCeZAM4m01sK4UbPfF14CvgRTQQJnJqjJhpcHNm9t5uHP78
...[truncated 27 chars]
The skill explicitly states it will write HTML reports to a local directory, but it does not declare any tool scope or permissions boundary for file writing. Missing capability scoping increases the blast radius if the skill is abused or mis-implemented, because a host may permit broader filesystem writes than users expect.
The document claims it does not collect directory paths, but later instructs the agent to read and write a fixed path under the user’s home directory. That inconsistency is dangerous because it understates filesystem interaction and can mislead users and reviewers about the skill’s actual access to local environment and persistent state.
This instruction explicitly prepares and sends collected device features to an external registration endpoint. External transmission itself is not always malicious, but here it sends host-derived identifiers for account creation in a skill whose stated purpose is bid analysis, making the data flow unnecessary and privacy-impacting in context.
> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>
The curl-based alternative reinforces that the skill is designed to send structured registration data off-host to a third-party endpoint. In context, this is part of an unnecessary enrollment workflow and increases the chance that host metadata is exfiltrated or mishandled outside the narrow bid-analysis use case.
> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>
> 历史教训：曾有版本采集 `home_path`，Windows 的 `C:\Users\alice` 直接拼进 JSON 字符串时
This duplicate session-persistence finding points to the same behavior: storing credentials and related state on disk for future reuse. In the context of a bid-analysis skill, that persistence is not essential to the core task and unnecessarily broadens the security boundary from one interaction to durable local auth management.
注意事项：
- 目录不存在时先 `mkdir -p ~/.zlbx`
- 文件已存在时**合并而非覆盖**（保留用户可能的其他配置）
- `source: "auto"` 字段必须写入，**这是后续判断「是否输出自动登录链接」的关键依据**
This duplicate session-persistence finding points to the same behavior: storing credentials and related state on disk for future reuse. In the context of a bid-analysis skill, that persistence is not essential to the core task and unnecessarily broadens the security boundary from one interaction to durable local auth management.
注意事项:
- 目录不存在时先 `mkdir -p ~/.zlbx`
- 文件已存在时**合并而非覆盖**(保留用户可能的其他配置)
- `source: "auto"` 字段必须写入,**这是后续判断「是否输出自动登录链接」的关键依据**
The instructions are written as unconditional output requirements for the report content and wording, effectively forcing a specific language/locale behavior. The file does not offer the user a language choice or explain that the skill is region-specific in a way that would justify the constraint under the stated policy.
The template instructs the agent to generate an HTML file locally, write intermediate JSON to a temporary file, and disclose the absolute filesystem path to the user. That expands behavior beyond in-chat analysis and can leak host environment details or create unintended artifacts on the runtime machine without explicit user consent.
No suspicious patterns detected.