Security audit

建筑工程标讯洞察-筑龙标事

Security checks across malware telemetry and agentic risk

Overview

The skill is mainly a bid-search API assistant, but it also provisions accounts, fingerprints the device, stores an API key locally, and can generate auto-login recharge links.

Install only if you are comfortable with the vendor service creating or reusing a trial account when no API key is configured, collecting a hashed MAC-derived device identifier after consent, and saving an API key under ~/.zlbx/config.json. To avoid that path, configure ZLBX_API_KEY yourself before use and handle recharge or login through the vendor site manually.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill instructs collecting device characteristics and performing automatic account registration when no API key is present, which exceeds the stated purpose of bid/query assistance. Even though it says to obtain consent first, the workflow still introduces unnecessary identity/device data collection and external account creation behavior into a data-query skill, increasing privacy and abuse risk.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill directs reading from and writing to a local config file for credential discovery and persistence, which is beyond the core querying function and creates secret-handling risk. This can expose or overwrite credentials on the host and normalizes local file access unrelated to answering the user’s request.

Context-Inappropriate Capability

Low

Confidence: 82% confidence
Finding: The skill includes generation of an auto-login/recharge link for depleted accounts, which is not necessary for bid insight functionality and expands the skill into account-management actions. While likely intended as convenience, it can steer users into authentication flows and link handling outside the skill’s core scope.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The document instructs the agent to collect device fingerprinting attributes, including a hashed MAC address, for automatic account registration. Even with hashing and user-consent language, this is unrelated to the skill’s stated bid-insight functionality and introduces privacy-sensitive collection that can uniquely track devices across sessions.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This section operationalizes automatic account creation, remote transmission of collected device data, receipt of an API key, and persistence of that credential into the user’s home directory. That behavior exceeds the advertised scope of an architecture bid-insight skill and creates a supply-chain style risk: the skill can provision third-party accounts and store credentials locally without being core to the user’s requested task.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The balance-exhaustion flow adds generation of a device SID and directs users into an auto-login and phone-binding/recharge funnel that is not reflected in the skill description. This expands the skill from data retrieval into account growth and monetization flows, increasing the chance of undisclosed identity linkage and social engineering-like redirection.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill instructs persisting an API key to a local config file without a prominent warning about long-term secret storage, file permissions, or local exposure risk. Storing credentials in plaintext or predictable locations can lead to accidental disclosure or theft by other local processes or users.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill describes collecting and transmitting platform, architecture, and MAC-derived device information for auto-registration without a prominent privacy disclosure in the skill description itself. Device fingerprint elements can be used for tracking and account linkage, so collecting them in a procurement-query skill is disproportionate and privacy-invasive.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation explicitly instructs the system to automatically match a user-provided company shorthand to multiple related entities and proceed with downstream analysis without user confirmation. In a business intelligence and bidding context, this can misattribute procurement, bidding, partner, or contact data across headquarters and subsidiaries, leading to incorrect conclusions, privacy issues, or actions taken against the wrong entity.

External Transmission

Medium

Category: Data Exfiltration
Content: > ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串 > > 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`， > 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`** > （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。 >
Confidence: 81% confidence
Finding: The finding reflects explicit guidance to send a JSON request to an external service as part of the registration workflow. In isolation, external transmission is normal, but in this file it is tied to off-scope device-feature collection and account creation, making the outbound transfer security-relevant rather than a harmless implementation detail.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.