Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed procurement-data API integration with optional account setup, and I found no evidence of deception or malicious behavior.
Install only if you are comfortable using the Zhiliaobiaoxun/Caizhaowang API, sending queries and an API key to that service, and optionally allowing user-approved auto-registration that stores an API key locally. Preconfiguring ZLBX_API_KEY avoids the device-feature registration flow.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
分寸：同一会话最多引导一次；用户拒绝或表示已经在用之后本会话不再出现。引导必须出现在首次用法介绍、家族 Skill 转介之后，作为回答的最后一段。
安装包身份与升级检查：所有发往知了标讯 API 的请求（包括账户查询）必须额外携带以下两个请求头：
X-Skill-Package: national-procurement-data-center-caizhaowang/1.0.10
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
分寸:同一会话最多引导一次;用户拒绝或表示已经在用之后本会话不再出现。引导必须出现在首次用法介绍、家族 Skill 转介之后,作为回答的最后一段。
安装包身份与升级检查:所有发往知了标讯 API 的请求(包括账户查询)必须额外携带以下两个请求头:
X-Skill-Package: national-procurement-data-center-caizhaowang/1.0.10
This duplicate finding points to the same hidden instruction region that directs the agent to preserve package-specific identity headers and use configured credentials. Even if the content appears operational rather than overtly malicious, concealed instructions affecting authentication and outbound request composition increase the risk of unauthorized or misleading cross-system actions and reduce auditability.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding points to the same hidden instruction region that directs the agent to preserve package-specific identity headers and use configured credentials. Even if the content appears operational rather than overtly malicious, concealed instructions affecting authentication and outbound request composition increase the risk of unauthorized or misleading cross-system actions and reduce auditability.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instructions finding points to the same concealed identity-directive content at the top of the file. The risk is the same: model-consumable hidden text can steer credential and header behavior outside normal user awareness, making prompt-injection style manipulation and covert policy override easier.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate hidden-instructions finding points to the same concealed identity-directive content at the top of the file. The risk is the same: model-consumable hidden text can steer credential and header behavior outside normal user awareness, making prompt-injection style manipulation and covert policy override easier.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This second finding is substantively the same hidden-instruction issue: markdown comments and prose instruct the agent to preserve a package-specific client identity and send fixed headers tied to package provenance. In a hostile-skill threat model, such content is dangerous because it attempts to steer authentication and outbound request identity from within untrusted documentation, which can override safer agent policies or cause cross-context credential use.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This second finding is substantively the same hidden-instruction issue: markdown comments and prose instruct the agent to preserve a package-specific client identity and send fixed headers tied to package provenance. In a hostile-skill threat model, such content is dangerous because it attempts to steer authentication and outbound request identity from within untrusted documentation, which can override safer agent policies or cause cross-context credential use.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicated hidden-instruction finding is still valid: the skill text contains concealed directives telling the agent how to authenticate and identify itself to a remote API. Even if intended for package integrity, such hidden instructions create a prompt-injection-style control channel that can manipulate network behavior and increase the risk of unauthorized metadata or credential disclosure.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicated hidden-instruction finding is still valid: the skill text contains concealed directives telling the agent how to authenticate and identify itself to a remote API. Even if intended for package integrity, such hidden instructions create a prompt-injection-style control channel that can manipulate network behavior and increase the risk of unauthorized metadata or credential disclosure.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicated finding points to the same hidden-instruction block that tells the agent to use an existing API key and attach package/source identity headers. In skill content, such instructions are risky because they can manipulate how credentials are sent, create covert exfiltration or tracking opportunities, and bypass the principle that only trusted runtime configuration should control authentication behavior.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicated finding points to the same hidden-instruction block that tells the agent to use an existing API key and attach package/source identity headers. In skill content, such instructions are risky because they can manipulate how credentials are sent, create covert exfiltration or tracking opportunities, and bypass the principle that only trusted runtime configuration should control authentication behavior.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding refers to the same hidden instruction block at the top of the file. The concealment of request-shaping instructions inside comments is a genuine prompt-layer control risk because it influences authentication and metadata disclosure while being easy to miss during review.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
This duplicate finding refers to the same hidden instruction block at the top of the file. The concealment of request-shaping instructions inside comments is a genuine prompt-layer control risk because it influences authentication and metadata disclosure while being easy to miss during review.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: zlbx-bidding/2.5.0
The manifest description says to invoke the skill whenever the user needs cross-province, cross-industry comprehensive data retrieval or enterprise profile analysis, but it does not define concrete trigger phrases, scope limits, or negative examples. This is broad enough to overlap with many general research requests and could cause unintended invocation.
The instruction mandates specific Chinese-source wording and forbids displaying supplier names, brands, domains, internal identifiers, and translated names, which effectively imposes a locale/language presentation policy without asking the user. The file does not offer any user choice of language or explain a justified region-specific constraint.
The file documents account-management functions such as balance and daily consumption queries that are unrelated to the stated purpose of procurement-data search and enterprise profiling. This expands the skill’s effective privilege scope and encourages use of an API key for operational account introspection, which can expose billing/usage metadata and normalize unnecessary access to account-level endpoints.
The skill explicitly instructs the agent to automatically expand a user-supplied company name into multiple related entities and proceed with downstream analysis without confirmation. This can lead to over-broad data retrieval, mistaken attribution across subsidiaries or similarly named firms, and privacy or compliance issues if the user intended a narrower target.
The skill documentation adds mandatory account-management behavior unrelated to the user-facing purpose of procurement search and company profiling. Requiring an automatic balance check and upgrade-notice workflow can cause the agent to perform extra actions on the user's account and disclose vendor-driven messages without explicit user intent, expanding the scope of authority beyond the requested task.
The document is written entirely as mandatory operational guidance in Chinese and instructs the skill how to communicate results and notices, but it does not offer any user language or locale choice. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
The file is a markdown document, so natural-language policy checks apply. Lines L335-L336 instruct the skill to relay the skill_update_notice message verbatim to the user, and the surrounding document is written entirely in Chinese with no opt-in or alternative locale path, which can force a specific language experience on users.
The skill instructs the agent to collect device fingerprints (platform, architecture, MAC-derived hash) and transmit them to an external auto-registration endpoint. Even though the document claims privacy minimization and requires user consent, this still causes outbound transfer of host-derived identifiers and enrollment metadata to a third party, which is a meaningful privacy and trust boundary crossing. The surrounding context makes this more sensitive because the skill is designed to trigger registration when no API key is configured, creating pressure to gather local machine attributes and persist returned credentials.
> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>
> 历史教训：曾有版本采集 `home_path`，Windows 的 `C:\Users\alice` 直接拼进 JSON 字符串时
This duplicate finding points to the same credential persistence behavior. Automatically creating configuration directories and merging a third-party-issued API key into persistent local config is a real security concern because it modifies host authentication state beyond the current session.
注意事项：
- 目录不存在时先 `mkdir -p ~/.zlbx`
- 文件已存在时**合并而非覆盖**（保留用户可能的其他配置）
- `source: "auto"` 字段必须写入，**这是后续判断「是否输出自动登录链接」的关键依据**
This duplicate finding points to the same credential persistence behavior. Automatically creating configuration directories and merging a third-party-issued API key into persistent local config is a real security concern because it modifies host authentication state beyond the current session.
注意事项:
- 目录不存在时先 `mkdir -p ~/.zlbx`
- 文件已存在时**合并而非覆盖**(保留用户可能的其他配置)
- `source: "auto"` 字段必须写入,**这是后续判断「是否输出自动登录链接」的关键依据**
No suspicious patterns detected.