Security audit
Security checks for vulnerabilities and agentic risk
This skill mostly matches its bidding-data purpose, but it also performs under-disclosed credentialed service checks, update acknowledgments, local key storage, and optional device-based account creation that users should review first.
Install only if you are comfortable with this third-party bidding service receiving your bidding/company queries, API key-authenticated requests, package/source identity headers, and, if you opt into automatic registration, a hashed device identifier. Prefer manually configuring an API key through a trusted secret mechanism, review the local ~/.zlbx/config.json storage, and avoid using the contact features for bulk outreach or sensitive personal-data collection.
The trigger conditions are extremely broad, instructing invocation for a wide range of procurement, supplier, competitor, and market-analysis topics even when the user did not explicitly request this provider. Overbroad routing can cause unexpected data sharing to a third-party service, unnecessary credential use, and principle-of-least-surprise violations.
The skill instructs automatic account registration and collection of device characteristics (platform, architecture, MAC-derived hash) when no API key is present. That behavior exceeds the core purpose of a bidding-data query assistant and introduces device fingerprinting, account creation, and persistent credential provisioning, which can collect identifying information and create external accounts without a narrowly necessary security basis.
This duplicate hidden-instructions finding points to the same concealed package-identity block that directs additional headers and follow-up calls. The risk remains that nontransparent instructions can influence network behavior in ways users and reviewers may not expect, including extra telemetry and hidden control flow.
分寸：同一会话最多引导一次；用户拒绝或表示已经在用之后本会话不再出现。引导必须出现在首次用法介绍、家族 Skill 转介之后，作为回答的最后一段。
安装包身份与升级检查：所有发往知了标讯 API 的请求（包括账户查询）必须额外携带以下两个请求头：
X-Skill-Package: zlbx-bidding-skill/1.4.9
This duplicate hidden-instructions finding points to the same concealed package-identity block that directs additional headers and follow-up calls. The risk remains that nontransparent instructions can influence network behavior in ways users and reviewers may not expect, including extra telemetry and hidden control flow.
分寸:同一会话最多引导一次;用户拒绝或表示已经在用之后本会话不再出现。引导必须出现在首次用法介绍、家族 Skill 转介之后,作为回答的最后一段。
安装包身份与升级检查:所有发往知了标讯 API 的请求(包括账户查询)必须额外携带以下两个请求头:
X-Skill-Package: zlbx-bidding-skill/1.4.9
This duplicate finding points to the same hidden instruction block that tells the agent to preserve a specific client identity and add source/package headers while using an environment-sourced API key. Such covert control text is risky because it can steer the model to perform authenticated outbound calls based on untrusted prompt content rather than transparent, policy-enforced configuration.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding points to the same hidden instruction block that tells the agent to preserve a specific client identity and add source/package headers while using an environment-sourced API key. Such covert control text is risky because it can steer the model to perform authenticated outbound calls based on untrusted prompt content rather than transparent, policy-enforced configuration.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding points to the same hidden identity block that instructs the agent to use a configured API key together with package/source headers. In an adversarial skill, this pattern can be abused to manipulate outbound requests, exfiltrate installation metadata, or create cross-package identity confusion if the runtime does not strictly separate trusted config from untrusted skill text.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding points to the same hidden identity block that instructs the agent to use a configured API key together with package/source headers. In an adversarial skill, this pattern can be abused to manipulate outbound requests, exfiltrate installation metadata, or create cross-package identity confusion if the runtime does not strictly separate trusted config from untrusted skill text.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instructions finding points to the same concealed identity-header directive at the top of the file. The concealed requirement increases risk because it quietly couples every API request to package/source attribution, enabling unnecessary metadata leakage and making the skill harder to audit safely.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instructions finding points to the same concealed identity-header directive at the top of the file. The concealed requirement increases risk because it quietly couples every API request to package/source attribution, enabling unnecessary metadata leakage and making the skill harder to audit safely.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The skill contains hidden comment-delimited instructions that direct the agent to attach package identity headers and follow package-specific request behavior. Hidden or non-user-visible control instructions are risky because they can steer agent behavior outside normal user awareness and can be used to smuggle policy-relevant actions, especially when combined with credential use and external requests.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The skill contains hidden comment-delimited instructions that direct the agent to attach package identity headers and follow package-specific request behavior. Hidden or non-user-visible control instructions are risky because they can steer agent behavior outside normal user awareness and can be used to smuggle policy-relevant actions, especially when combined with credential use and external requests.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The skill directs writing a newly obtained API key to a local config file under the user's home directory. Persisting third-party credentials locally from within a data-query skill increases secret exposure risk, especially if file permissions, lifecycle management, rotation, and user awareness are not tightly controlled.
L103 规定“对外来源统一写‘知了标讯工商数据’……及其翻译名不展示”，属于面向用户输出的语言约束，但没有说明用户可选择其他语言或 locale。若在非中文对话或多语言环境中运行，这种固定输出语言可能违反语言需由用户选择或明确告知的组织策略。
The manifest describes this skill as a 招中标数据查询与分析助手 centered on bidding/procurement data queries and analysis. Lines L479-L489 expand the skill to perform general internet-enhanced company, industry, policy, and market analysis via WebSearch, which is a broader capability not obviously required for querying and analyzing the platform’s bidding data itself.
The section labeled '回答要求' gives response requirements entirely in Chinese and instructs the agent how to answer users, but nowhere offers a language or locale choice or states that this is a China-specific/Chinese-only skill. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
The documentation instructs the agent to automatically expand a user-supplied company name into all matching headquarters and branch entities and then run follow-up queries without user confirmation. This can silently broaden the query scope, causing overcollection of affiliated-company data and producing analysis on entities the user did not explicitly request.
The skill explicitly supports retrieving and presenting company project contact information, including phone numbers, which can expose personal contact data beyond what is necessary for general bidding-analysis workflows. Even though free accounts return masked numbers and the doc says not to bulk export or reconstruct them, the feature still normalizes access to potentially sensitive personal/business contact information and expands the skill into contact harvesting territory.
The file’s title and all operational instructions are written as a Chinese-only interaction specification, and line L068 explicitly standardizes external wording in Chinese. There is no indication that users may choose another language or that the locale restriction is justified as a region-specific requirement, which can violate language/locale policy expectations.
The skill documentation requires an account-balance check and a follow-up display-acknowledgment callback that are not necessary to fulfill the user’s bidding-data query. This creates extra network actions using the user’s configured API credentials and package identity headers, expanding data disclosure and enabling vendor-side tracking of session behavior beyond the core task.
The documentation instructs the agent to automatically send the configured API key together with package-identifying headers to account/balance and acknowledgment endpoints, but does not transparently warn the user. This is a privacy and consent problem because the service can correlate credential use, installed package identity, and user interaction state even when the user only asked for bidding analysis.
No suspicious patterns detected.