中标结果查询与竞争分析

• Outcome: Review
• Latest audit: Jul 18, 2026 · 5:53 AM UTC
• Version: 1.0.0

Overview

The skill provides bid-analysis APIs, but it can silently fingerprint the device, create a remote account, store an API key, and generate login/recharge links without clear user approval.

Review before installing. Prefer setting your own ZLBX_API_KEY if you use this skill, and avoid letting it auto-register unless you are comfortable sending device and local user identifiers to the provider and storing an issued API key under ~/.zlbx/config.json. Treat any contact details returned by the APIs as personal or business-sensitive data and use them only for authorized procurement work.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill instructs automatic account registration when no API key is present, including collection of device fingerprints and persistence of a returned credential to local storage. That behavior is not necessary for bid-award analysis and creates an undisclosed account-creation and tracking flow that can expose user/device identity and silently modify the host environment.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill directs collection of hostname, platform, architecture, username, home path, and MAC-derived data for authentication fallback. These identifiers are sensitive, enable device correlation or fingerprinting, and are disproportionate to the stated purpose of querying public procurement results.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill includes generation of an automatic-login/recharge link tied to a device/session identifier, which is unrelated to the core analysis function and expands the scope into account lifecycle and monetization flows. This can steer the agent into creating login artifacts and exposing users to opaque authentication redirections.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The document instructs the agent to perform functions far beyond bidding analysis: collecting host identifiers, auto-registering a remote account, persisting returned credentials locally, and generating auto-login links for recharge. This expands the skill into covert onboarding and credential management without clear user consent, creating privacy, security, and scope-creep risks inconsistent with the declared purpose.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill directs collection of device fingerprint data such as hostname, username, home path, architecture, and hashed MAC address, then transmits them to a remote auto-registration endpoint. These identifiers are unrelated to competitive bidding analysis and enable cross-session device tracking and profiling, especially when combined into a stable device ID.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The file defines remote account creation, key issuance, local credential storage, and auto-login/recharge handling, none of which are necessary to answer procurement-analysis queries. This gives the skill the ability to create and manage service accounts on the user's behalf and nudge billing-related actions, increasing the blast radius if misused or if the remote service is compromised.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The workflow silently collects device-related identifiers and writes an API key into ~/.zlbx/config.json without any user-facing warning about privacy implications or local persistence. Hidden collection and storage reduce informed consent and can leave credentials resident on disk where other local processes or users may access them.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The instruction to suppress any mention of auto-registration, auto-login, or device binding in some cases is a strong transparency failure and an adversarial red flag. Concealing sensitive account and device actions from the user impairs oversight and increases the chance that the agent performs privacy-impacting behavior without informed awareness.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill documents an API that returns named project contacts and phone numbers tied to bidding activity, but provides no warning, minimization guidance, or usage constraints for handling personal data. In a competitive bid-analysis skill, exposing contact data can facilitate unsolicited outreach, profiling, or targeted social engineering against procurement staff and bidders.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The instructions tell the agent to gather and send potentially sensitive device identifiers but provide no requirement to notify the user or obtain consent. Even though the MAC is hashed, the resulting value remains a persistent pseudonymous identifier that can support tracking and account linkage.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs writing an API key to a persistent config file in the user's home directory without a visible warning or consent step. Silent local credential persistence can surprise users, increase secret exposure on shared systems, and cause unintended long-term reuse of auto-created accounts.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The automatic registration flow collects device and user-identifying attributes without clear disclosure, which is a data-handling vulnerability because it gathers more identifying information than needed for the declared analytics task. In this skill context, the mismatch between procurement analysis and host/device fingerprint collection makes the behavior more suspicious and less justifiable.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The explicit suppression of disclosure regarding auto-registration and device-binding behavior undermines user awareness of sensitive data and account actions. Hiding such behavior is especially dangerous in an analysis-only skill because it signals intent to mask side effects unrelated to the user’s requested procurement research.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.