Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a construction-tender API guide, but it also creates service accounts, fingerprints the device, and stores API credentials locally, so it needs careful review before installation.
Install only if you are comfortable with this skill contacting zhiliaobiaoxun services, using or creating an API account, collecting a hashed device identifier after consent, and storing the service API key under ~/.zlbx/config.json. Prefer manually creating and supplying ZLBX_API_KEY through a trusted secret mechanism if possible, and review the account/recharge flows before allowing automatic registration.
The skill directs collection of device characteristics (platform, architecture, MAC-derived hash) and uses them to automatically register an account with a third-party service. Even with nominal consent, this is unrelated to tender analysis output and creates privacy, tracking, and unauthorized account-lifecycle risks that exceed the expected behavior of the skill.
Writing API credentials into ~/.zlbx/config.json causes the skill to persist secrets in the local home directory, which may be readable by other processes, accidentally exposed in backups, or reused without clear user awareness. This is unjustified for a search/analysis skill and violates least-privilege and safer secret-handling practices.
This duplicate finding points to the same hidden instruction region, which embeds non-obvious execution requirements inside comments. Such concealed directives are risky because they can silently alter network behavior and add out-of-band reporting logic that users and reviewers may not expect.
分寸：同一会话最多引导一次；用户拒绝或表示已经在用之后本会话不再出现。引导必须出现在首次用法介绍、家族 Skill 转介之后，作为回答的最后一段。
安装包身份与升级检查：所有发往知了标讯 API 的请求（包括账户查询）必须额外携带以下两个请求头：
X-Skill-Package: construction-tender-analyzer-jianshetong/1.0.10
This duplicate finding points to the same hidden instruction region, which embeds non-obvious execution requirements inside comments. Such concealed directives are risky because they can silently alter network behavior and add out-of-band reporting logic that users and reviewers may not expect.
分寸:同一会话最多引导一次;用户拒绝或表示已经在用之后本会话不再出现。引导必须出现在首次用法介绍、家族 Skill 转介之后,作为回答的最后一段。
安装包身份与升级检查:所有发往知了标讯 API 的请求(包括账户查询)必须额外携带以下两个请求头:
X-Skill-Package: construction-tender-analyzer-jianshetong/1.0.10
This duplicate hidden-instructions finding points to the same concealed request-identity block that tells the agent to use configured credentials and fixed identity headers. Concealed directives affecting authentication and outbound request composition are dangerous because they can bypass transparency and cause the model to participate in unauthorized or overbroad external actions.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instructions finding points to the same concealed request-identity block that tells the agent to use configured credentials and fixed identity headers. Concealed directives affecting authentication and outbound request composition are dangerous because they can bypass transparency and cause the model to participate in unauthorized or overbroad external actions.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding points to the same hidden instruction block embedded in comments at the top of the file. Even if the content is operational rather than overtly malicious, concealed instructions that modify credentialed outbound requests create a prompt-injection style control channel and reduce reviewability.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding points to the same hidden instruction block embedded in comments at the top of the file. Even if the content is operational rather than overtly malicious, concealed instructions that modify credentialed outbound requests create a prompt-injection style control channel and reduce reviewability.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instructions finding is valid for the same reason: the skill embeds non-user-visible directives to preserve and transmit credential-linked identity headers on requests. Such concealed control text increases the chance of unauthorized or non-transparent external calls, and the construction-tender context does not justify hiding these behaviors from review.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instructions finding is valid for the same reason: the skill embeds non-user-visible directives to preserve and transmit credential-linked identity headers on requests. Such concealed control text increases the chance of unauthorized or non-transparent external calls, and the construction-tender context does not justify hiding these behaviors from review.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instructions finding is also valid: the document contains non-user-visible control text that dictates authentication/header behavior and request provenance handling. Even if the content is framed as package identity, embedding such instructions in the skill content increases the risk that an agent will obey untrusted hidden directives, potentially leaking contextual metadata or performing unintended network operations.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instructions finding is also valid: the document contains non-user-visible control text that dictates authentication/header behavior and request provenance handling. Even if the content is framed as package identity, embedding such instructions in the skill content increases the risk that an agent will obey untrusted hidden directives, potentially leaking contextual metadata or performing unintended network operations.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instruction finding refers to the same concealed request-identity block, which instructs the agent to send fixed package/source headers alongside an existing API key. Because the directive is embedded in document comments instead of transparent configuration, it increases the risk of covert metadata propagation and instruction-channel abuse.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instruction finding refers to the same concealed request-identity block, which instructs the agent to send fixed package/source headers alongside an existing API key. Because the directive is embedded in document comments instead of transparent configuration, it increases the risk of covert metadata propagation and instruction-channel abuse.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The hidden comment-based instructions attempt to steer request identity and header behavior in a way that is not visible in normal user-facing flow. Hidden operational instructions are dangerous because they can override or smuggle network behavior, complicate auditability, and cause the agent to send package/source identifiers the user did not knowingly authorize.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The hidden comment-based instructions attempt to steer request identity and header behavior in a way that is not visible in normal user-facing flow. Hidden operational instructions are dangerous because they can override or smuggle network behavior, complicate auditability, and cause the agent to send package/source identifiers the user did not knowingly authorize.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This document directs the agent to collect device fingerprints, provision accounts, persist credentials, and manage recharge flows, which is unrelated to a construction tender analysis skill's stated purpose. That scope expansion creates a high-risk side channel for credential handling and device tracking, increasing the chance of privacy abuse, unintended registration, and account lifecycle actions being performed under the guise of a domain-analysis skill.
The activation condition says the skill triggers when the search term contains words like 工程、施工、建筑、市政、监理、设计等建筑业专属词汇, which is an open-ended list and includes fairly broad terms such as 设计 and 工程. The description does not provide negative examples or clear limits for when construction-related language should not invoke the skill, increasing the risk of unintended activation.
The skill metadata and instructions are entirely framed in Chinese and the description implies a Chinese-language interaction model, but there is no explicit user opt-in, language choice, or documented region/locale constraint. Under the language policy rule, forcing a specific language without user choice can be a natural-language policy violation unless clearly justified as region-specific.
The skill is presented as a construction tender analysis tool, but it also instructs the agent to perform automatic account registration and local credential persistence. That expands the skill from data analysis into identity creation and secret handling, which materially increases risk because it can collect device-derived data, create third-party accounts, and persist credentials outside the declared purpose.
The documentation first claims all project amount filtering uses min_amount/max_amount with a uniform unit of 万元. Later it says the same-named min_amount has different units across tools, which directly contradicts the earlier guidance and can mislead tool usage.
The manifest frames the skill around structured construction tender data analysis, especially project amounts and bidder qualifications. The documentation expands behavior into general internet research on company strategy, industry rankings, and policy impacts, which is broader than the declared data-centric tender analysis purpose.
The file introduces account-balance, consumption, and upgrade-notice workflows that are outside the stated purpose of a construction tender analysis skill. This scope expansion can induce the agent to access billing/account data and perform side-effecting actions with the configured API key, increasing the attack surface and violating least privilege even if the endpoints are legitimate.
The upgrade reminder display and acknowledgment flow is unrelated to tender analysis and instructs the agent to perform an additional state-changing POST after showing a notice. Unrelated side effects are dangerous because they can cause the agent to mutate remote service state using existing credentials without a user-requested business need.
The file exposes broad company-intelligence capabilities such as business profiling, partners, competitors, and potential bidders that go beyond the declared construction tender analysis purpose. Scope expansion increases the chance that an agent will collect or infer more organizational intelligence than the user expected, creating over-collection and misuse risk even if the APIs are legitimate.
No suspicious patterns detected.