全网招中标数据平台-知了标讯

• Outcome: Review
• Latest audit: Aug 14, 2026 · 12:10 PM UTC
• Version: 1.4.3

Overview

This is mainly a tender-search API skill, but it needs Review because it includes an under-disclosed auto-registration flow that sends a device-derived identifier and stores an API key locally.

Install only if you are comfortable with queries and company identifiers being sent to Zhiliaobiaoxun, and with the optional first-run registration flow collecting a hashed MAC-derived device identifier and saving an API key under ~/.zlbx/config.json. Prefer manually setting ZLBX_API_KEY if you want to avoid auto-registration, and confirm exact company scope before broad group or subsidiary analysis.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: This document instructs the agent to perform account creation, write persistent credentials to local disk, and generate auto-login flows, which materially exceed the stated purpose of a tender search/analysis skill. Even though the flow asks for consent, it expands the skill into credential lifecycle management and local state mutation, increasing privacy, persistence, and abuse risk if the skill is invoked unexpectedly or by prompt manipulation.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill collects device fingerprint material (platform, CPU architecture, and a MAC-derived hash) to identify a device and transmits it to a remote service. For a procurement search skill, this is not necessary to answer user queries, and the hashed MAC still functions as a stable cross-session identifier that can enable tracking, account linking, and privacy harm.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The skill description mandates use for a very broad set of common procurement- and competitor-related terms, which can force invocation even when the user's request may not require this external service. This increases the chance of unnecessary third-party data disclosure and weakens agent routing controls, especially because the trigger scope includes generic business analysis scenarios rather than narrowly bounded tender-search tasks.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill instructs sending user-supplied queries and company identifiers to an external API but does not provide a user-facing warning or consent mechanism. In this context, requests may contain sensitive business intelligence such as target suppliers, competitors, procurement plans, or internal sourcing interests, so silent transmission creates privacy, confidentiality, and compliance risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documented workflow tells the agent to automatically aggregate all semantically matching companies, including headquarters and subsidiaries, and then use that expanded set for follow-on queries without user confirmation. This can cause over-collection and mis-scoped analysis, especially when a user intended only one legal entity, leading to unintended disclosure of affiliated-company data and incorrect procurement conclusions.

External Transmission

Medium

• Category: Data Exfiltration

Content

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>

• Confidence: 87% confidence
• Finding: This section explicitly instructs the agent to transmit collected device features to an external endpoint as part of auto-registration. External transmission of host-derived identifiers is sensitive here because the skill's purpose is search/analysis, not endpoint enrollment, and the transmission creates a privacy and data-governance risk beyond user expectations.

External Transmission

Medium

• Category: Data Exfiltration

Content

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>
> 历史教训：曾有版本采集 `home_path`，Windows 的 `C:\Users\alice` 直接拼进 JSON 字符串时

• Confidence: 83% confidence
• Finding: The curl example reinforces and operationalizes the same external exfiltration path, making it easier for an implementing agent to send local device-derived data off-host. In context, this is not just generic networking guidance: it supports remote registration using fingerprint-like attributes unrelated to tender search, so the skill context makes the transmission more concerning.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.