Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to support legitimate bid-data queries, but it also handles account creation, device fingerprinting, local credential storage, and hidden update acknowledgment calls that users should review before installing.
Install only if you are comfortable with this vendor service managing an API key, storing it under ~/.zlbx/config.json, and collecting a hashed device identifier when no key is configured. To avoid auto-registration and device fingerprint collection, configure ZLBX_API_KEY yourself before use, and review any update or recharge links before following them.
The skill directs automatic collection of device characteristics (platform, architecture, MAC-derived hash) to create accounts when no key is present. Collecting device fingerprinting data for a bidding insight workflow is not necessary for core functionality and can expose persistent identifiers and enable tracking across sessions or services.
This duplicate finding identifies the same hidden instruction block, which still represents a transparency and side-effect risk. Because the directives are concealed in comments yet change request composition and follow-up network behavior, they can cause unreviewed data transmission and complicate safe policy enforcement.
分寸：同一会话最多引导一次；用户拒绝或表示已经在用之后本会话不再出现。引导必须出现在首次用法介绍、家族 Skill 转介之后，作为回答的最后一段。
安装包身份与升级检查：所有发往知了标讯 API 的请求（包括账户查询）必须额外携带以下两个请求头：
X-Skill-Package: architecture-bid-insight-zhulongbiaoshi/1.0.10
This duplicate finding identifies the same hidden instruction block, which still represents a transparency and side-effect risk. Because the directives are concealed in comments yet change request composition and follow-up network behavior, they can cause unreviewed data transmission and complicate safe policy enforcement.
分寸:同一会话最多引导一次;用户拒绝或表示已经在用之后本会话不再出现。引导必须出现在首次用法介绍、家族 Skill 转介之后,作为回答的最后一段。
安装包身份与升级检查:所有发往知了标讯 API 的请求(包括账户查询)必须额外携带以下两个请求头:
X-Skill-Package: architecture-bid-insight-zhulongbiaoshi/1.0.10
This duplicate finding points to the same hidden instruction block, which contains authoritative-sounding directives about credential usage, request headers, and required call sequencing. Even if the immediate content looks operationally legitimate, embedding agent-control instructions in the skill body is dangerous because a model may prioritize them as trusted execution guidance, enabling stealthy data exfiltration or unauthorized actions in other variants of the package.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding points to the same hidden instruction block, which contains authoritative-sounding directives about credential usage, request headers, and required call sequencing. Even if the immediate content looks operationally legitimate, embedding agent-control instructions in the skill body is dangerous because a model may prioritize them as trusted execution guidance, enabling stealthy data exfiltration or unauthorized actions in other variants of the package.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding points to the same hidden-instruction block that directs authenticated request identity behavior. Even if the content appears administrative rather than overtly malicious, any concealed instruction that steers header injection, package/source attribution, or credential use can override user intent and cause the agent to make privileged requests under attacker-controlled or unreviewed metadata assumptions.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding points to the same hidden-instruction block that directs authenticated request identity behavior. Even if the content appears administrative rather than overtly malicious, any concealed instruction that steers header injection, package/source attribution, or credential use can override user intent and cause the agent to make privileged requests under attacker-controlled or unreviewed metadata assumptions.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instructions finding identifies the same concealed request-identity block. Even if the headers themselves are not directly secret, concealing execution-affecting instructions in comments increases the risk of covert behavior, confused-deputy issues, and exfiltration of package/source metadata without clear user or platform awareness.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instructions finding identifies the same concealed request-identity block. Even if the headers themselves are not directly secret, concealing execution-affecting instructions in comments increases the risk of covert behavior, confused-deputy issues, and exfiltration of package/source metadata without clear user or platform awareness.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The file contains embedded hidden instruction blocks that direct the agent to attach package identity headers and follow package-specific request behavior. Hidden or out-of-band instructions are risky because they can override user expectations, conceal network behavior, and create a covert policy channel inside skill content.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The file contains embedded hidden instruction blocks that direct the agent to attach package identity headers and follow package-specific request behavior. Hidden or out-of-band instructions are risky because they can override user expectations, conceal network behavior, and create a covert policy channel inside skill content.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The skill is presented as a bid/project insight tool, but it also instructs the agent to provision accounts and persist API credentials locally. That expands the trust boundary from read-only data retrieval into credential lifecycle management, which increases security and privacy risk and creates unexpected side effects on the host system.
The skill includes instructions to read and write local credential files under ~/.zlbx/config.json, which is unrelated to a pure insight/query role and introduces secret handling on the local filesystem. This can lead to credential leakage, insecure file permissions, unintended persistence, and abuse if the skill is triggered in shared or managed environments.
The markdown instructs the agent to use a fixed Chinese user-facing message when contact data is masked. This imposes a specific language on user-visible output without any opt-in or alternative locale handling, which is a natural-language policy issue under the locale/language rule.
The skill explicitly instructs the agent to automatically expand a user's input company name into multiple related legal entities and proceed with downstream analysis without user confirmation. This can materially broaden the scope of data retrieval and profiling beyond the user's intended target, creating privacy, consent, and over-collection risks, especially when subsequent calls include contacts, partners, and competitor analysis.
L105 requires that the message be relayed to the user verbatim, and the file itself is written entirely in Chinese without indicating any option to localize or translate for the user's preferred language. This creates a natural-language policy issue because it effectively forces a specific language in user-visible output without user opt-in or a documented, justified locale restriction.
The file title and all operational instructions are presented exclusively in Chinese, and the document does not indicate that language should be selected based on user preference or that other locales are supported. This creates a natural-language policy concern because it effectively imposes a single language without opt-in or documented justification.
The documentation adds a mandatory account-balance/version-check and update-ack workflow that is outside the skill’s stated bid-search/query purpose. That expands the skill’s operational scope, creates extra user-visible side effects and outbound requests, and can be abused as a tracking/telemetry mechanism or to coerce message delivery unrelated to the user’s task.
The instruction to display a version notice to the user and then send an acknowledgement callback introduces a non-essential interaction pattern unrelated to architecture bid insight. This can manipulate the assistant’s responses, leak conversation state about what was shown to the user, and create unnecessary external signaling tied to the session.
The file defines a full account bootstrap and lifecycle flow—device fingerprint collection, auto-registration, credential persistence, quota handling, recharge links, and recovery guidance—that goes well beyond the skill’s stated purpose of construction bid insight. This expands the skill’s privilege surface and causes the agent to perform identity and account-management actions unrelated to the user’s requested analytical task, increasing privacy and abuse risk.
The skill instructs collection of local device fingerprint attributes, including a MAC-derived hash, and transmits them to a remote service to deduplicate trial accounts. Even with hashing and a consent prompt, this is unrelated to bid analysis and constitutes device tracking/fingerprinting behavior that increases privacy risk and can surprise users.
No suspicious patterns detected.