Security audit
Security checks for vulnerabilities and agentic risk
This bidding-advice skill is mostly coherent, but it asks for account setup, device fingerprinting, persistent API-key storage, and shareable signed links that users should review before installing.
Install only if you are comfortable using the Zhiliaobiaoxun/ZLBX service for bid-data queries. Prefer configuring your own ZLBX_API_KEY if available; otherwise the auto-registration flow will ask consent, collect platform/CPU/MAC-hash device features, contact the vendor, and store an API key under ~/.zlbx/config.json. Treat generated HTML reports and any URLs containing sk or auto-login parameters as shareable access links, not ordinary public links.
声明描述的是一个面向用户的分析型技能，核心应是根据招标项目和历史数据进行策略判断与生成结论。实际代码仅负责把一个既有 JSON 结果渲染为 HTML 报告，属于展示层/输出层组件。虽然报告字段覆盖了声明中的多个分析维度（如结论、采购方分析、竞争格局、报价参考、风险、行动建议、数据引用），但这些内容都被假定已经存在于输入 JSON 中，代码本身没有实现数据检索、模型分析、竞争对手预测、预算画像、投标决策或中标概率计算。因此其实际主要目的与声明的技能用途存在实质性偏差。
Referenced artifact was not completely inspected
完整模式下，对话报告输出后默认再用 `scripts/render_report.py` 生成一份可分享的 HTML 版报告并告知保存路径（详见 report-template.md「HTML 报告导出」）。
Referenced artifact was not completely inspected
完整模式下，对话报告输出后默认再用 `scripts/render_report.py` 生成一份可分享的 HTML 版报告并告知保存路径（详见 report-template.md「HTML 报告导出」）。
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
安装包身份与升级检查：所有发往知了标讯 API 的请求（包括账户查询）必须额外携带以下两个请求头：
X-Skill-Package: ai-bidding-strategy-advisor/1.0.9
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
安装包身份与升级检查:所有发往知了标讯 API 的请求(包括账户查询)必须额外携带以下两个请求头:
X-Skill-Package: ai-bidding-strategy-advisor/1.0.9
This duplicated hidden-instruction finding points to the same issue: the skill document contains embedded directives telling the agent exactly which authenticated headers and source identifiers to send. Even if operationally legitimate, such prompt-resident instructions are dangerous because they can override normal request construction, leak package/source metadata, and cause the agent to make credentialed calls the user did not explicitly request.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: bid-decision/1.0.5
This duplicated hidden-instruction finding points to the same issue: the skill document contains embedded directives telling the agent exactly which authenticated headers and source identifiers to send. Even if operationally legitimate, such prompt-resident instructions are dangerous because they can override normal request construction, leak package/source metadata, and cause the agent to make credentialed calls the user did not explicitly request.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: bid-decision/1.0.5
This duplicated hidden-instructions finding refers to the same comment-block behavior: concealed directives that modify request identity and provenance headers. In a skill already exceeding its scope, hidden directives increase the risk of unnoticed data sharing and make the package more adversarial than a normal transparent prompt artifact.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: bid-decision/1.0.5
This duplicated hidden-instructions finding refers to the same comment-block behavior: concealed directives that modify request identity and provenance headers. In a skill already exceeding its scope, hidden directives increase the risk of unnoticed data sharing and make the package more adversarial than a normal transparent prompt artifact.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: bid-decision/1.0.5
The file embeds a full automatic account-registration and credential-management workflow inside a skill advertised as a bidding strategy advisor. That adds unrelated capability to inspect local state, collect device-derived identifiers, contact external services, provision accounts, and persist API keys, creating a substantial expansion of authority beyond the user’s expected task context.
The skill instructs the agent to collect platform, CPU architecture, and a SHA256 hash of the MAC address to create a device fingerprint for account issuance. Even hashed, this is persistent device-linked telemetry unrelated to producing bidding advice, and it can deanonymize or track users across sessions while normalizing host inspection behavior in an unrelated skill.
This duplicate hidden-instruction finding points to the same concealed request-identity block that influences outbound authenticated requests. Concealed prompt directives that manipulate headers and package/source attribution can bypass user awareness and increase the chance of unauthorized or over-scoped API use if the template is reused in other contexts.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: bid-decision/1.0.5
This duplicate hidden-instruction finding points to the same concealed request-identity block that influences outbound authenticated requests. Concealed prompt directives that manipulate headers and package/source attribution can bypass user awareness and increase the chance of unauthorized or over-scoped API use if the template is reused in other contexts.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: bid-decision/1.0.5
The instructions require preserving signed sk parameters in shared URLs and explicitly frame them as bypassing a login wall, but provide no warning that these links may embed bearer-like access tokens. Embedding such signed links in reports and HTML exports can leak access-granting tokens to recipients, logs, browser history, analytics systems, or any party the report is forwarded to.
This appears to be a duplicate hidden-instructions finding on the same line range, but it still identifies a real issue: concealed prompt directives controlling credentialed request behavior. Even if the intent is package integrity rather than abuse, the use of hidden instructions reduces transparency and increases the chance of covert data handling or prompt-injection-style control over the agent.
请求身份：使用已配置的 API Key，并保留本包的 X-Client，携带下列完整身份头；不得沿用其它包的版本或来源。
X-Client: bid-decision/1.0.5
This appears to be a duplicate hidden-instructions finding on the same line range, but it still identifies a real issue: concealed prompt directives controlling credentialed request behavior. Even if the intent is package integrity rather than abuse, the use of hidden instructions reduces transparency and increases the chance of covert data handling or prompt-injection-style control over the agent.
请求身份:使用已配置的 API Key,并保留本包的 X-Client,携带下列完整身份头;不得沿用其它包的版本或来源。
X-Client: bid-decision/1.0.5
Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
THREAT_COLOR = {"高": "#c0392b", "中": "#b9770e", "低": "#0d9463"}
# 知了标讯白色 logo（299x96 PNG base64 内嵌，保证报告离线/打印/转发时不裂图）
_LOGO_B64 = "iVBORw0KGgoAAAANSUhEUgAAASsAAABgCAYAAABFTFSvAAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAABK6ADAAQAAAABAAAAYAAAAACurZhBAAA2V0lEQVR4Ae2dB5xU1fXHzzZ6752ldxHpHTtqTKJJjEmMGkvKP/aIRk0UayzYxZJouokaYyzRiKCAoIB0kN47LB0WFnZh9//9vZmHb4eZnZndmWVW3vl8fjOv3fvuO+++3z3nvHvvM/PF14CvAV8DFUADafbM2OusKOMCKywoqgDlDV/ENIpemJ5vGYW5VmjbrChtlaXZYks7usRuumlb+ET+Vl8DvgYqkgYyzdJ6WqWskXa0IhU7UlnTzLgiK4K8jh7litK22FPPT4O03rb8zAk26hc5kVL6230N+BpIbQ1kWpEdsYJ8Hu4jqV3SeEuXlpZBkhaWmf49s/RvW9aRFfbs2D9ZweF/2i23bIo3O/94XwO+Bk6sBtJP7OmTeHZZV0JBgdmRI1mWnt7V0jIesozK7+H6/shGj66UxLP7Wfsa8DWQYA18fcnKq6iAWxggrbS0XpDWc1a34dP2zDMtvIf5y74GfA2krgZODrJy9e+SVuHROpae8ROC8i/bsy/1cHf7/74GfA2krgZOLrJy70NhoWJ0lXENz8Tces6eHHuqu8v/9zXgayA1NXBykpXuhayswkJeMKQPtHR7greGnVLzFvml8jXga0AaOHnJSlfvENbRLEtLG2BphaPtiSfqabMvvgZ8DaSeBk5ustL9EGEVFVW1jIwzLC3rlyzTWcsXXwO+BlJNAz5Z6Y4ohnXkaCPLSP++PfnCkFS7SX55fA34GjjZ3cDjakBatqUduQZ3sOpxu/wNvgZ8DZxQDfiWlav+gDtY3TKz+plVHupu9v99DfgaSA0N+GTlvQ8Bwmpm6YUX2htvaLiOL74GfA2kiAaST1bEr5Miycq3sLAm5e1jG7e3SUq5/Ux9DfgaKJUGkkNWRxgUfUSTHjAJQjqnKGRZ6wpklyQByybyEZpIQeC4jHQy1/HKV9sSIcovLS0NV7ARhcUd9MXXgK+BVNGAJlRJnEBGVbOy7Lz2be1bbdtax3p1LYtnf1tenk3euMneWrHSVu7cbTCNSAGyUU9yCILV9IxMq5KVaUfZdPioBh9DQDomTXxaZNUyM613s2Z2UYe2dlrDhlaD8+w5nG8zt22zd1atthlbmcZKZChyLKsUFtWxtKJTyOYfZc3KT+9rwNdAYjSQZk8//wKk8POyThGTAfF0b9DQHh022M5p3eq40slr27R/vz06a649N28uYSGzVnXr2vltWtvpLVpY29q1rHqlLDsC4ew8dMjm5+yw91avsbk5260mxHRr3952eZdOVp3lUNHxf1m01B6bNdu25uZChmUINzkEmXYIa+1dGPNKppPJCz2fv+5rwNdA+WsgIZZVBpbPKQ0b2avnn2tdsKaO4E6t3L3bpm/ZagcKjjgW1sAmTaxFzZr20JCB1q1BPQwXw0pqZw2rhu8lMBQr6mendLecgwctl2leOkFsynfdvn32xdYcZ3vzmjWsb+NG1rxGDefYJtWr2k2Tpth20pTJwioqghHTGllWVl1uiU9W5V8v/TP6GjhOAwkhq/pVqth9gwY4RLU3P98enTnHnsd62pN32IkrZeLi9Wve1P5w1unWtX59+1mP7scVJNyGLFw6EZGkEKKat32H3Txxkk1du94ho0xcQ+V3W7/e9oNOHe2c7NZ2Q699ds/n05nduJTCeZAM4m01sK4UbPfF14CvgRTQQJnJqjJhpcHNm9t5uHP78
...[truncated 27 chars]
The skill explicitly instructs the agent to write HTML reports to a local directory, but it does not declare any corresponding tool scope such as file-write permissions. Undeclared write capability weakens sandboxing and user consent boundaries, because a host may permit broader filesystem actions than the manifest communicates.
The activation rule is very broad, instructing use of the skill for nearly any phrasing related to bidding, quoting, or winning a tender. Overbroad triggering can cause the agent to invoke a high-cost external workflow unexpectedly, send user data to third-party APIs without sufficiently specific intent, and perform actions beyond what the user meant.
The description is written as a mandatory Chinese-language skill behavior and does not provide an opt-in or alternative language path. Under the policy, forcing a specific language without user choice is a natural-language locale policy concern unless clearly justified as region-specific.
The document is written as prescriptive agent guidance and explicitly says the privacy notice can be relayed verbatim to the user, with all example user-facing text in Chinese. It does not offer a language choice or state that Chinese is required by a region-specific context, so it imposes a locale on user interactions without opt-in.
This location documents sending collected device features to an external registration endpoint. External transmission alone is not always unsafe, but in this context it exports device-derived identifiers for a non-core function of the skill, making privacy exposure and unexpected data sharing a real risk.
> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>
> 历史教训：曾有版本采集 `home_path`，Windows 的 `C:\Users\alice` 直接拼进 JSON 字符串时
The document directs the agent to write API keys to ~/.zlbx/config.json, merge config state, tag credential source, and immediately reuse the stored key for future calls. This is account and secret lifecycle management embedded in a domain skill, increasing the blast radius of compromise and encouraging persistent storage of sensitive credentials without platform-level safeguards.
This duplicate finding points to the same persistence behavior: creating ~/.zlbx, merging user config, and immediately activating a stored key. Persistent state mutation and authentication carryover significantly expand the skill’s authority and create residual risk even after the bidding task ends.
注意事项：
- 目录不存在时先 `mkdir -p ~/.zlbx`
- 文件已存在时**合并而非覆盖**（保留用户可能的其他配置）
- `source: "auto"` 字段必须写入，**这是后续判断「是否输出自动登录链接」的关键依据**
No suspicious patterns detected.