招投标AI数据分析平台

• Outcome: Review
• Latest audit: Oct 14, 2026 · 11:17 PM UTC
• Version: 1.0.8

Overview

This appears to be a real bidding-data API helper, but it needs review because it can create and store credentials, fingerprint the device, and make extra account/update acknowledgement calls beyond the visible data query.

Install only if you are comfortable with this provider receiving authenticated API requests, package/source headers, and, during automatic registration, a hashed device identifier. Prefer manually configuring ZLBX_API_KEY if you do not want the auto-registration flow or local credential file, and review the update-notice acknowledgement behavior before using it in a sensitive environment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (34)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill instructs collection of device fingerprint attributes (platform, architecture, MAC-derived hash) to obtain an API key, even though those identifiers are not needed to answer bidding-analysis queries. Collecting persistent device characteristics for account creation creates privacy risk, enables cross-session tracking, and exceeds the minimum data required for the feature's stated purpose.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 94% confidence

Finding

This duplicated hidden-instructions finding is still valid because the commented block changes request composition and introduces side effects such as notice display acknowledgment. Such concealed control logic undermines transparency and makes it easier to hide vendor-tracking or nonessential network actions inside a seemingly data-analysis skill.

Content

Scanner excerpt · SKILL.md (reported line 537)May include surrounding context.

分寸：同一会话最多引导一次；用户拒绝或表示已经在用之后本会话不再出现。引导必须出现在首次用法介绍、家族 Skill 转介之后，作为回答的最后一段。

安装包身份与升级检查：所有发往知了标讯 API 的请求（包括账户查询）必须额外携带以下两个请求头：

text

X-Skill-Package: ai-bidding-data-platform/1.0.8

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 94% confidence

Finding

This duplicated hidden-instructions finding is still valid because the commented block changes request composition and introduces side effects such as notice display acknowledgment. Such concealed control logic undermines transparency and makes it easier to hide vendor-tracking or nonessential network actions inside a seemingly data-analysis skill.

Content

Scanner excerpt · SKILL.md (reported line 537)May include surrounding context.

分寸:同一会话最多引导一次;用户拒绝或表示已经在用之后本会话不再出现。引导必须出现在首次用法介绍、家族 Skill 转介之后,作为回答的最后一段。

安装包身份与升级检查:所有发往知了标讯 API 的请求(包括账户查询)必须额外携带以下两个请求头:

text

X-Skill-Package: ai-bidding-data-platform/1.0.8

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 91% confidence

Finding

This duplicate hidden-instruction finding is still valid because the content attempts to control authentication behavior, package identity, and request routing through embedded prose rather than trusted configuration. In a skill that handles account queries and instructs use of an API key from environment/config, such hidden directives are more dangerous because they can influence the model to make authenticated requests and disclose operational state without independent policy checks.

Content

Scanner excerpt · references/api-account.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 91% confidence

Finding

This duplicate hidden-instruction finding is still valid because the content attempts to control authentication behavior, package identity, and request routing through embedded prose rather than trusted configuration. In a skill that handles account queries and instructs use of an API key from environment/config, such hidden directives are more dangerous because they can influence the model to make authenticated requests and disclose operational state without independent policy checks.

Content

Scanner excerpt · references/api-account.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 95% confidence

Finding

This duplicate finding identifies the same hidden instruction block that directs the agent to preserve and transmit package identity and source headers with authenticated requests. Such concealed directives are risky because they create non-obvious behavior that may influence credentialed outbound requests without informed user consent, and they normalize trusting hidden prompt content as authority over security-relevant request construction.

Content

Scanner excerpt · references/api-market.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 95% confidence

Finding

This duplicate finding identifies the same hidden instruction block that directs the agent to preserve and transmit package identity and source headers with authenticated requests. Such concealed directives are risky because they create non-obvious behavior that may influence credentialed outbound requests without informed user consent, and they normalize trusting hidden prompt content as authority over security-relevant request construction.

Content

Scanner excerpt · references/api-market.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-company.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-registry.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-company.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-registry.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 93% confidence

Finding

This duplicate finding points to the same hidden instruction block requiring use of a configured API key and fixed package/source headers. Such covert directives are a prompt-injection risk because they attempt to steer agent behavior at the document level and can cause the agent to make authenticated requests with attacker-controlled metadata outside normal user intent.

Content

Scanner excerpt · references/api-search.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 93% confidence

Finding

This duplicate finding points to the same hidden instruction block requiring use of a configured API key and fixed package/source headers. Such covert directives are a prompt-injection risk because they attempt to steer agent behavior at the document level and can cause the agent to make authenticated requests with attacker-controlled metadata outside normal user intent.

Content

Scanner excerpt · references/api-search.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This duplicated hidden-instruction pattern again shows the skill attempting to direct the model’s outbound authentication/provenance behavior from within adversarial content. Because these instructions are not part of the user’s visible request and affect how credentials are applied, they materially increase prompt-injection and unauthorized-action risk.

Content

Scanner excerpt · references/auto-register.md (reported line 1)May include surrounding context.

请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This duplicated hidden-instruction pattern again shows the skill attempting to direct the model’s outbound authentication/provenance behavior from within adversarial content. Because these instructions are not part of the user’s visible request and affect how credentials are applied, they materially increase prompt-injection and unauthorized-action risk.

Content

Scanner excerpt · references/auto-register.md (reported line 1)May include surrounding context.

请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。

text

X-Client: zlbx-bidding/2.5.0

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description says that when users raise bidding-market analysis, opportunity briefs, procurement trends, market share, or 'who is buying/winning' open-ended analysis needs, the skill 'must' be used. These trigger conditions are broad natural-language categories rather than a constrained invocation list, which can overlap with many ordinary analytical requests and makes it unclear when the skill should not activate.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill instructions and user-facing guidance are entirely written to operate in Chinese and include prescriptive output text in Chinese, but do not state that language choice is optional or user-selected. This can amount to a language/locale policy violation because the skill implicitly forces a specific language without opt-in or documented regional necessity.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill expands from bidding-data analytics into account lifecycle handling by directing automatic registration and writing credentials to a local config file. That introduces unnecessary secret-handling and persistence behavior outside the stated purpose, increasing the attack surface for credential misuse, unauthorized account creation, and local secret exposure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest positions the skill as a bidding-data AI analysis platform centered on tendering datasets and related market analysis. These lines broaden operation to general internet enrichment via WebSearch, including company websites, news, industry rankings, supply chain, and policy analysis, which exceeds the manifest's narrower data-platform framing.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

These sections instruct the skill to recommend other skills and an external agent after completing user requests, including installation links and upsell-style transfer logic. Product referral and cross-promotion are not direct capabilities required for bidding-data analysis and are unrelated to the manifest's stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly instructs the agent to automatically expand a user-provided company name to all semantically matched entities, including headquarters and subsidiaries, and then continue analysis without confirmation. This can cause over-collection and disclosure of data about entities the user did not clearly request, creating scope creep, privacy, and accuracy risks in downstream analysis.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest describes a bidding-data AI analysis platform focused on market analysis, aggregation, trend analysis, and prediction. Lines L387-L395 add package/account-management workflow requirements, including querying an account endpoint and submitting POST acknowledgements, which are operational/package-lifecycle behaviors rather than user-facing bidding analysis functions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file contains mandatory user-facing instruction text such as '将其中 message 原样转达用户' and '只有将提醒发送到用户可见对话之后' in a Chinese-only document context. This effectively enforces a specific language/locale behavior without stating that the user may choose another language or that the constraint is region-specific and justified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is presented as a bidding-data analysis platform, but the documented behavior additionally enforces package identity headers and an upgrade-notice acknowledgement workflow. That mismatch expands the skill’s effective scope beyond pure analysis into package tracking and message-delivery side effects, which can surprise the agent and user and weaken least-privilege expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill documentation requires a mandatory account-balance/version-check call and a follow-up acknowledgement flow before or alongside normal bidding analysis. This introduces extra side effects unrelated to the user’s requested data task, creating a covert control channel to exfiltrate package usage telemetry or force user-visible messaging not strictly necessary for the analysis workflow.

Content

No source excerpt is available for this finding.