全国采招大数据中心-采招网

• Outcome: Review
• Latest audit: Sep 1, 2026 · 12:49 PM UTC
• Version: 1.0.4

Overview

The skill is mainly for procurement-data queries, but it needs Review because it can register an account using a MAC-derived device hash, save an API key locally, and create auto-login recharge links.

Review before installing if you are uncomfortable with device-based account creation. To avoid the sensitive path, configure ZLBX_API_KEY yourself before first use; otherwise the skill may ask permission to collect platform, CPU architecture, and a hashed MAC address, send them to the provider, store an API key in ~/.zlbx/config.json, and later show an auto-login recharge link if free quota is exhausted.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The skill instructs the agent to collect device characteristics (platform, arch, mac_hash) and perform automatic account registration when no API key is present. That expands the skill from procurement-data retrieval into device fingerprinting and credential acquisition, creating unnecessary privacy and account-creation risk for a data-query skill.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill directs the agent to persist a newly obtained API key into ~/.zlbx/config.json. Writing credentials to local disk is outside the stated query purpose and can expose secrets through file leakage, unintended reuse across contexts, or abuse by other local processes.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The SID generation and auto-login recharge flow adds account-management and payment-related actions unrelated to procurement search. Even if intended for convenience, it broadens the skill's privileges and could steer users into authentication or billing flows without strong separation from the core data-access function.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill implements account auto-registration, stores credentials locally, and manages login/recharge flows that are outside the declared procurement-search and enterprise-analysis purpose. This expands the skill’s effective scope from data retrieval into identity/account lifecycle management, increasing the chance of unauthorized persistence, hidden side effects, and user surprise even if framed as a convenience feature.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill collects device fingerprinting material (platform, architecture, and a hashed MAC-derived identifier) and sends it to an external service for account creation, which is unrelated to the declared business function of procurement search/profile analysis. Even with hashing and stated minimization, MAC-derived identifiers still enable stable device correlation and create privacy and tracking risk beyond user expectations for this skill.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The balance-exhaustion logic generates auto-login session links and steers the user toward phone binding and recharge workflows, extending the skill into account monetization and authentication flows not reflected in the declared purpose. Auto-login links are sensitive session artifacts, and producing them inside a search skill increases the risk of confusing trust boundaries and exposing login tokens in user-visible output.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly instructs the agent to automatically expand a short company name to multiple related entities, including headquarters and subsidiaries, and proceed without user confirmation. This can cause over-collection and misattribution of business intelligence across legally distinct entities, producing privacy-sensitive or commercially misleading analysis when the user intended only one company.

External Transmission

Medium

• Category: Data Exfiltration

Content

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>

• Confidence: 78% confidence
• Finding: This line documents and encourages transmitting collected device features and registration metadata to an external endpoint. In isolation, external transmission is not always unsafe, but in this skill context the transmitted data supports undisclosed account provisioning and device tracking beyond the declared procurement-search purpose, making the network exfiltration materially risky.

External Transmission

Medium

• Category: Data Exfiltration

Content

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>
> 历史教训：曾有版本采集 `home_path`，Windows 的 `C:\Users\alice` 直接拼进 JSON 字符串时

• Confidence: 76% confidence
• Finding: The curl-based example is another documented pathway for sending the same registration payload to an external service. The risk is not the serialization advice itself, but that the skill operationalizes outbound transfer of device-derived identifiers and account-creation data unrelated to the advertised search functionality.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.