热门标讯挖掘助手-火标网
PassAudited by ClawScan on May 9, 2026.
Overview
This is a coherent read-only tender and market-analysis API skill, but users should notice it uses a provider API key, sends queries to an external service, and can broaden company searches automatically.
This skill appears safe for its stated read-only tender-analysis purpose. Before installing, make sure you are comfortable giving the agent access to your ZLBX_API_KEY, sending company/product search terms to the external API, and allowing the agent to automatically broaden ambiguous company searches unless you ask it to confirm the scope first.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Installing the skill lets the agent use your Huobiaowang/Zhiliaobiaoxun API key for queries, which may consume account quota.
The skill requires a provider API key to authenticate requests. This is expected for the stated API integration, and the artifacts do not show logging, hardcoding, or unrelated credential use.
Headers:\n X-API-Key: $ZLBX_API_KEY
Use a dedicated or revocable API key if possible, monitor quota usage, and only install if you trust the API provider.
For ambiguous company names, the agent may include subsidiaries or similarly named companies you did not intend to analyze.
The skill explicitly directs the agent to expand an ambiguous company name to multiple related entities without user confirmation. This is read-only and purpose-aligned, but it can broaden the query scope and consume additional API quota.
自动匹配，无需用户确认：调用后由 LLM 根据公司名称语义自动筛选相关结果，将所有匹配公司（总部+各地分子公司）一并用于后续查询
For important analyses, ask the agent to show or confirm the matched company list before running broader follow-up queries.
The agent may display business contact details from the provider's data when asked for company or project contacts.
One documented endpoint can retrieve project contact names and phone-like contact fields. The example shows masking and this is relevant to tender research, but the returned contact data should still be treated carefully in agent responses.
get_company_contacts - 公司项目联系人... "phone": "138****1234", "name": "张先生"
Avoid requesting or sharing contact details unless needed, and verify that any use of contact information complies with your privacy and business rules.