工程建设招投标分析-建设通

• Outcome: Review
• Latest audit: Sep 1, 2026 · 1:02 PM UTC
• Version: 1.0.4

Overview

This skill provides construction tender analysis, but it also provisions accounts using a device fingerprint and stores credentials locally, so users should review it before installing.

Install only if you are comfortable with the service creating or reusing an account when no API key is configured, sending a hashed device identifier to the provider after consent, storing the resulting API key under ~/.zlbx/config.json, and showing account recharge/login links in chat when quota is exhausted. Prefer configuring ZLBX_API_KEY yourself to avoid the auto-registration path.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The document instructs the agent to automatically create remote accounts, transmit device-derived identifiers, and store returned API credentials locally, all of which exceed the declared tender-analysis purpose of the skill. Even though it asks for consent and minimizes fields, this is still an undeclared identity/provisioning workflow that expands the skill’s privilege and data-handling scope and could be abused to enroll users into a third-party service without clear necessity.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill prescribes collection of platform, CPU architecture, and a hashed MAC address for device deduplication. A hashed MAC is still a stable device fingerprint, and using it in a tender-analysis skill is disproportionate to the stated function, enabling tracking/account linkage unrelated to user-requested analysis.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The instructions direct the agent to write API keys into a predictable file path and merge account-state metadata into local config. Credential persistence is outside the narrow tender-analysis scope and increases the blast radius if the host is shared, compromised, or if other tools read the same file.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The recharge flow generates account-linked auto-login URLs based on API key state and instructs the agent to present them to the user. This extends the skill into account management and monetization workflows unrelated to tender analysis, and the auto-login token could be sensitive if exposed in logs, chat history, or telemetry.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger description is broad enough to activate on many generic construction-related terms, which can cause the skill to engage in conversations where the user did not intend to use this external bidding-data workflow. That increases the chance of unnecessary API use, unintended disclosure of user queries to a third-party service, and incorrect routing away from more appropriate skills.

Natural-Language Policy Violations

Medium

• Confidence: 81% confidence
• Finding: The skill description is written to operate in Chinese by default without indicating any language negotiation or user preference handling. This can degrade user control and transparency, and in multilingual environments may lead to misunderstood outputs or accidental disclosure of sensitive results in an unintended language.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation explicitly instructs the agent to automatically expand a shorthand company query into multiple related legal entities and continue with downstream analysis without user confirmation. This can cause over-broad data collection, mistaken attribution across subsidiaries, and disclosure of information about entities the user did not clearly intend to analyze, especially when company names are ambiguous or group structures are complex.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This API supports retrieval of project contact information, including phone numbers and names, and the surrounding guidance focuses on display behavior rather than strong privacy, purpose-limitation, or anti-harvesting controls. Even if some numbers are masked for lower-tier accounts, the skill still enables targeted collection of personal contact data that could be misused for spam, social engineering, or bulk lead generation.

External Transmission

Medium

• Category: Data Exfiltration

Content

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>

• Confidence: 88% confidence
• Finding: This section explicitly instructs making an outbound HTTP request carrying device features to an external service. External transmission is expected for some skills, but in this context the transmitted data supports undeclared registration/fingerprinting behavior rather than core tender analysis, making the network exfiltration risk materially more concerning.

External Transmission

Medium

• Category: Data Exfiltration

Content

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>
> 历史教训：曾有版本采集 `home_path`，Windows 的 `C:\Users\alice` 直接拼进 JSON 字符串时

• Confidence: 84% confidence
• Finding: The curl example reinforces and operationalizes outbound transmission of registration data to a third-party endpoint. While the snippet itself is not exploit code, it facilitates network transfer of device-derived identifiers for a purpose beyond the stated skill scope.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.