招投标AI数据分析平台

• Outcome: Review
• Latest audit: Jul 17, 2026 · 11:59 PM UTC
• Version: 1.0.0

Overview

The skill provides bidding-data analysis, but it also silently registers the device with a remote service, sends host identifiers, and stores a returned API key locally.

Review before installing. Use a manually provided API key if possible, and avoid allowing automatic registration unless you are comfortable sending device identifiers to the provider and storing a new API key in ~/.zlbx/config.json. Treat contact lookups as sensitive personal data and use them only where you have a legitimate, authorized business need.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill instructs automatic collection of multiple device identifiers and silent account registration when no API key is present, which is unnecessary for answering bidding-data analysis queries. This creates an unjustified data exfiltration path and external account creation flow, increasing privacy risk and enabling tracking of the host environment without informed user consent.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill directs the agent to persist a newly obtained API key in ~/.zlbx/config.json, introducing local credential storage beyond the stated analytics purpose. Storing credentials in a home-directory file can expose secrets to other local processes, backups, or unintended reuse, especially when done automatically without user approval.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The documented auto-login and recharge flow extends the skill beyond bidding analysis into account monetization and session-link generation. This increases the attack surface by encouraging creation of authenticated links and payment-related navigation unrelated to the core analytical task, which could be abused for phishing-like redirection or unauthorized account actions.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The documented `get_company_contacts` capability exposes project contact information, including names and phone numbers, which goes beyond aggregated market-intelligence use and moves into handling potentially sensitive personal data. In the context of a bidding-analysis skill, this creates a clear risk of privacy misuse, targeted solicitation, or social-engineering enablement, especially because the documentation frames it as a routine analysis feature without guardrails.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The document instructs the agent to automatically register an account with a remote service, obtain an API key, and persist that credential locally even though the skill is described as a bidding-analysis tool rather than an account-provisioning or identity-enrollment workflow. This expands the skill's authority beyond its stated purpose, creates an unprompted trust relationship with an external service, and can cause silent account creation and credential storage on behalf of the user.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill collects a set of device fingerprinting attributes including hostname, platform, architecture, username, home path, and a hashed MAC-derived identifier, none of which are necessary for ordinary bidding-data analysis. Even with hashing of the MAC address, this enables cross-session device correlation and leaks sensitive host metadata to a third party without a clear, task-related justification.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The skill includes logic to generate device-linked auto-login links and guide the user through recharge and phone-binding flows, which are unrelated to the core bidding-analysis purpose. This increases phishing-like behavior and user-manipulation risk by turning the skill into an acquisition and billing funnel rather than a narrowly scoped analysis tool.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The activation rule says the skill must be used for broad open-ended market-analysis requests, making the trigger scope overly expansive. Overbroad invocation increases the chance the agent will route unrelated user requests into this skill, unnecessarily exposing user prompts, causing unintended external API calls, and activating the problematic registration/credential behaviors more often.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The auto-registration flow explicitly collects hostname, platform, architecture, username, home path, and MAC-derived data, sends them to a remote service, and stores returned credentials without any user-facing warning or consent. In the context of a data-analysis skill, this is especially dangerous because the collection is unrelated to the user's analytical request and silently expands the skill into host fingerprinting and remote identity provisioning.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The documentation instructs the system to automatically resolve ambiguous company names and proceed with downstream analysis without user confirmation. This can cause overcollection, misattribution across affiliated or similarly named entities, and privacy/compliance issues if the agent silently expands scope beyond the specific company the user intended.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: A contact-information endpoint is documented without any privacy warning, use restriction, or handling guidance despite returning personal contact details. In a skill designed for market and bidding analysis, omission of privacy safeguards materially increases the chance that users or downstream agents will treat personal data access as unrestricted and normal.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The auto-registration request transmits multiple host and user identifiers to a remote endpoint without any clear user-facing warning, consent step, or necessity tied to the user's immediate task. Silent exfiltration of device metadata is a significant privacy and trust violation, especially in an agent context where users may not expect local system characteristics to be harvested.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to persist a newly obtained API key into the user's home directory automatically and make it active in the current session without prior warning or approval. Silent local secret storage can surprise users, create residual access on shared systems, and bypass normal expectations around credential lifecycle management.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill combines collection of device and user identifiers with local credential creation and persistence, all without notice. This creates a covert onboarding mechanism that can deanonymize the environment, establish lasting access for future sessions, and make unauthorized external account linkage difficult for the user to detect or control.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.