医疗器械与耗材寻源-医疗器械招标网

• Outcome: Review
• Latest audit: Nov 4, 2026 · 4:19 PM UTC
• Version: 1.0.11

Overview

Optional signup sends a lasting device identifier while describing it as non-identifying, which warrants review.

Prefer supplying your own ZLBX_API_KEY to bypass device collection. Before accepting automatic signup, understand that its MAC-derived hash can recognize your device despite the reassuring wording. Company and product search terms go to Zhiliaobiaoxun, and queries can consume credits. The reviewed artifacts do not establish the provider's retention or deletion practices. Other scanner concerns about ordinary API requests, credential storage, and update acknowledgments did not establish malicious behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code performs local host identification rather than medical-device sourcing or tender analysis. Accessing and hashing a network interface's MAC address is not an evident supporting implementation detail of the declared purpose. No price-trend or brand-analysis calls, procurement queries, or bid-detail processing appear in this chunk. The code does not show transmission of the resulting hash.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied shell code performs local device identification rather than medical procurement searches or pricing analysis. Nothing in the declared purpose explains why a MAC-address-derived identifier is needed. The chunk does not show registration, transmission, or exfiltration of that identifier.

Content

No source excerpt is available for this finding.

Mandatory external queries lack a user-facing disclosure that search terms are sent to a third-party service.

Medium

• Category: Output Handling
• Confidence: 88% confidence

Finding

The description requires price-trend and brand-analysis API calls whenever users ask about specific medical-device brands, models, or consumables. Although the file documents the external endpoints and authentication, it does not instruct the agent to warn users that their query terms will be transmitted to that provider; the consent requirement at L052–L054 covers device-feature collection during registration only.

Content

No source excerpt is available for this finding.

API-key onboarding includes device fingerprint collection unrelated to medical-device sourcing.

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The skill instructs the agent to collect platform, architecture, and a MAC-derived hash for submission to an account-registration endpoint. Although it requires user consent, this device-identification capability extends beyond retrieving medical-device prices, specifications, brands, and purchasing organizations; hardware fingerprinting is not an obvious requirement for those queries.

Content

No source excerpt is available for this finding.

The skill mandates an unrelated package-update notification and acknowledgment workflow.

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

The manifest describes medical-device sourcing, price trends, and brand analysis, but these instructions require a session-initial account request to check package-update notices, verbatim delivery of server-provided messages, and an authenticated POST acknowledging their display. This adds remote update-notification state management that is not necessary to retrieve device prices, specifications, or procurement details.

Content

No source excerpt is available for this finding.

Automatic company-search workflow sends user-provided company names to an external service without a privacy disclosure.

Medium

• Category: Output Handling
• Confidence: 88% confidence

Finding

This workflow explicitly instructs the agent to submit the user's company name to search_company and reuse matched names in subsequent queries without user involvement. Unlike a passive API catalog entry, it directs actual transmission of user-supplied query data, but provides no user-facing notice that these names will be sent to the external 知了标讯 service.

Content

No source excerpt is available for this finding.

Mandatory upgrade-notification and acknowledgment workflow is unrelated to medical-device sourcing.

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

L351–L353 require an authenticated account request each session to check upgrade notices, relay the server-provided message, and submit a POST acknowledgment after displaying it. This package-maintenance workflow introduces user-facing messaging and a remote state change that are not needed to retrieve medical-device prices, specifications, purchasing organizations, or brand analysis.

Content

No source excerpt is available for this finding.

The skill mandates an authenticated upgrade-notification and acknowledgment workflow unrelated to medical-device sourcing.

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

L393–L395 require a first-use account request to check upgrade reminders, verbatim delivery of server-provided notices, and an authenticated POST acknowledging their display. This adds package-maintenance messaging and remote acknowledgment state changes beyond the manifest's purpose of retrieving medical-device prices, specifications, brand analysis, and purchaser details.

Content

No source excerpt is available for this finding.

L081–L093 expose paid construction-engineering qualification queries unrelated to the declared medical-device sourcing purpose.

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The registry provides callable endpoints for construction, design, surveying, and engineering-supervision qualifications, including instructions to retrieve individual qualification details. These are explicitly construction credentials rather than medical-device certifications, and the manifest does not justify this separate capability; the documented list-plus-detail workflow also incurs six credits.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/auto-register.md (reported line 130)May include surrounding context.

md

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/auto-register.md (reported line 131)May include surrounding context.

md

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>
> 历史教训：曾有版本采集 `home_path`，Windows 的 `C:\Users\alice` 直接拼进 JSON 字符串时

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/auto-register.md (reported line 195)May include surrounding context.

text

注意事项：
- 目录不存在时先 `mkdir -p ~/.zlbx`
- 文件已存在时**合并而非覆盖**（保留用户可能的其他配置）
- `source: "auto"` 字段必须写入，**这是后续判断「是否输出自动登录链接」的关键依据**

The skill collects and transmits a persistent hardware-derived device fingerprint for trial-account registration, beyond its stated medical-device sourcing purpose.

Medium

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

The registration workflow transmits a stable, unsalted hardware-derived identifier while describing the collected features as having no identifying significance. Hashing a MAC address does not prevent persistent device recognition or correlation, so the consent language understates the privacy implications; explicit opt-in and the existing-key bypass reduce, but do not eliminate, this concern.

Content

No source excerpt is available for this finding.

Construction-engineering qualification queries exceed the medical-device sourcing purpose.

Low

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The skill exposes paid construction-engineering qualification list and detail queries, despite its manifest describing medical-device and consumable sourcing. These construction-specific capabilities have no stated connection to device award prices, technical parameters, or purchasing-unit details; requiring an explicit user request limits execution but does not establish their relevance to the declared purpose.

Content

No source excerpt is available for this finding.

L334-L336 mandate an authenticated package-update notification and acknowledgment workflow unrelated to medical-device sourcing.

Low

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

The manifest describes medical-device procurement searches, price trends, and brand analysis. These instructions additionally require checking an account endpoint for package-update notices, relaying those notices, and submitting an authenticated POST acknowledgment that changes notification state; this package-maintenance workflow is not needed to retrieve procurement information.

Content

No source excerpt is available for this finding.