Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a disclosed tender-search integration, but it also handles account creation, device fingerprinting, API-key persistence, and account-status callbacks in ways users should review carefully.
Install only if you are comfortable with this vendor service reading an API key from ZLBX_API_KEY or ~/.zlbx/config.json, creating a trial account after consent, sending a hashed MAC-derived device identifier for trial deduplication, and storing the returned API key locally. Prefer configuring your own API key explicitly and review the amount-unit documentation before relying on financial filters.
The skill instructs automatic account registration and collection of device characteristics (platform, arch, mac_hash) when no key is present, which is not necessary to perform a basic tender search. This introduces privacy risk, creates accounts on the user’s behalf, and persists credentials locally, all of which can be abused or performed without adequately informed consent.
This duplicate hidden-instructions finding points to the same concealed package-identity block, which injects non-obvious request metadata and follow-up acknowledgement logic. Concealed control text increases the risk of unnoticed data transmission and unexpected side effects beyond the user’s search request.
分寸：同一会话最多引导一次；用户拒绝或表示已经在用之后本会话不再出现。引导必须出现在首次用法介绍、家族 Skill 转介之后，作为回答的最后一段。
安装包身份与升级检查：所有发往知了标讯 API 的请求（包括账户查询）必须额外携带以下两个请求头：
X-Skill-Package: massive-tender-smart-search-biao800/1.0.10
This duplicate hidden-instructions finding points to the same concealed package-identity block, which injects non-obvious request metadata and follow-up acknowledgement logic. Concealed control text increases the risk of unnoticed data transmission and unexpected side effects beyond the user’s search request.
分寸:同一会话最多引导一次;用户拒绝或表示已经在用之后本会话不再出现。引导必须出现在首次用法介绍、家族 Skill 转介之后,作为回答的最后一段。
安装包身份与升级检查:所有发往知了标讯 API 的请求(包括账户查询)必须额外携带以下两个请求头:
X-Skill-Package: massive-tender-smart-search-biao800/1.0.10
This duplicate hidden-instructions finding is substantiated by the same concealed request-identity block at the top of the file. Concealed instructions that tell the agent which headers and provenance values to send are especially risky in a skill context because they can silently steer authentication context and outbound request metadata without transparent user awareness.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instructions finding is substantiated by the same concealed request-identity block at the top of the file. Concealed instructions that tell the agent which headers and provenance values to send are especially risky in a skill context because they can silently steer authentication context and outbound request metadata without transparent user awareness.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The markdown includes hidden comment-delimited operational instructions that tell the agent to attach specific identity headers and follow package-specific request behavior. Hidden instructions are dangerous because they can override or bypass higher-level policy expectations, create covert routing or attribution behavior, and are not visible as normal user-facing disclosures.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The markdown includes hidden comment-delimited operational instructions that tell the agent to attach specific identity headers and follow package-specific request behavior. Hidden instructions are dangerous because they can override or bypass higher-level policy expectations, create covert routing or attribution behavior, and are not visible as normal user-facing disclosures.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instruction finding points to the same issue: concealed directives at the top of the file instruct the agent to preserve and transmit specific identity headers tied to the package source/version. In an adversarial skill setting, concealed instructions can manipulate agent behavior, steer trust decisions, and silently influence outbound requests in ways the user cannot inspect or consent to.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instruction finding points to the same issue: concealed directives at the top of the file instruct the agent to preserve and transmit specific identity headers tied to the package source/version. In an adversarial skill setting, concealed instructions can manipulate agent behavior, steer trust decisions, and silently influence outbound requests in ways the user cannot inspect or consent to.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding points to the same hidden identity-header directive at the start of the file. Even if the headers themselves are legitimate for routing, placing them as hidden instructions inside skill content creates prompt-injection-like control over authenticated request construction and expands the trusted computing base unnecessarily.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding points to the same hidden identity-header directive at the start of the file. Even if the headers themselves are legitimate for routing, placing them as hidden instructions inside skill content creates prompt-injection-like control over authenticated request construction and expands the trusted computing base unnecessarily.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The document gives contradictory guidance on amount units for query_bids_advanced: one section says it uses the same min_amount/max_amount semantics as search_bids in 万元, while a later section claims query_bids_advanced and related tools use 元. In a financial search tool, this inconsistency can silently produce 10,000x incorrect filters, causing materially wrong results and potentially misleading business decisions.
The hidden comment embeds operational instructions about preserving package identity headers and request provenance. Hidden instructions can bypass normal user visibility and steer the agent to disclose or assert package metadata in all requests, making behavior less transparent and harder for users to audit.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The hidden comment embeds operational instructions about preserving package identity headers and request provenance. Hidden instructions can bypass normal user visibility and steer the agent to disclose or assert package metadata in all requests, making behavior less transparent and harder for users to audit.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The file defines an extensive auto-registration and account-management workflow, including device fingerprint collection, API key provisioning, persistence, billing flows, and login-link generation. Those capabilities materially exceed the stated purpose of a tender-search assistant and create unnecessary access to local system attributes and long-lived credentials, increasing the attack surface if the skill is abused or repurposed.
The skill instructs collection of device characteristics including platform, architecture, and a MAC-derived hash, then transmits them for account provisioning. Even with hashing, this is persistent device fingerprinting unrelated to the user's search query and can enable tracking, correlation, or unintended deanonymization across sessions.
The instructions direct the agent to write the returned API key into ~/.zlbx/config.json and reuse it in future sessions. Persisting credentials in a predictable plaintext file outside secure secret storage expands the blast radius of host compromise, accidental disclosure, or misuse by other local processes.
The skill name, description, examples, and user-facing instruction templates are entirely in Chinese, and the guidance assumes Chinese output such as fixed Chinese response snippets. There is no opt-in for language preference and no documented policy justification that this skill must operate only in Chinese.
The description says to invoke the skill whenever a user provides 'complex search conditions' such as multiple keywords, exclusions, or amount ranges, but it does not define clear limits or non-examples. This broad natural-language trigger could overlap with many ordinary information requests and lead to unintended invocation.
The skill’s documented behavior extends beyond tender search into credential discovery, local config access, account lifecycle actions, and promotional flow control. Expanding scope this far increases the attack surface and grants the skill opportunities to handle secrets and persistent state unrelated to the user’s search request, which is risky for a search-oriented skill.
The manifest positions the skill as a tender smart search assistant focused on combining search filters and returning accurate data. The documentation adds broader internet research capabilities—company deep analysis, policy impact, industry ranking, and market forecasting—which are qualitatively different from the declared data-query function.
The skill is described as a tender-search assistant, but this file adds account-balance and consumption-query capabilities using the configured API key. That is a scope expansion beyond the stated purpose and can cause unintended access to billing and account metadata without the user clearly requesting or expecting account-related operations.
The package includes an upgrade-check and display-acknowledgment workflow unrelated to the advertised tender-search function. This introduces extra outbound requests and state-changing behavior tied to the user's credentials, creating hidden side effects and an unnecessary control channel that can be abused for tracking, telemetry, or unauthorized workflow execution.
No suspicious patterns detected.