招中标数据智能体-AI驱动的标讯分析Agent

• Outcome: Review
• Latest audit: Aug 14, 2026 · 2:36 AM UTC
• Version: 1.0.2

Overview

The skill is a real bidding-data integration, but it asks agents to create accounts, collect a device fingerprint, store credentials, and generate auto-login recharge links in ways that need careful review before installation.

Install only if you are comfortable with this skill contacting zhiliaobiaoxun.com, using or creating a ZLBX API key, storing that key under ~/.zlbx/config.json, and sending a hashed device identifier for trial-account deduplication. Prefer setting your own ZLBX_API_KEY first, and treat contact-phone queries and auto-login recharge links as sensitive workflows that should be user-directed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to automatically collect device characteristics, call a remote registration endpoint, and persist a returned API key to a local config file when no key is present. That behavior exceeds the stated bidding-data query purpose and introduces undisclosed account creation, fingerprinting, and local credential storage, which are sensitive side effects an agent should not perform silently.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill includes logic to generate an auto-login or recharge link via a separate authentication endpoint, which is not necessary for core bid-data analysis. This expands the skill into account-access and payment-adjacent behavior, increasing the chance of silent session bootstrapping, phishing-like flows, or inappropriate steering of users into monetization paths.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The documented `get_company_contacts` API provides project contact information including names and phone numbers, and the guidance explicitly supports exposing full phone numbers to paid accounts. Even though the data may be partially masked for some users, this is still personal contact data that is not strictly necessary for many bidding-analysis use cases and could enable privacy violations, unsolicited outreach, scraping, or downstream misuse at scale.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The document instructs the agent to collect a MAC-derived device fingerprint and use it to automatically register an external account when no API key is configured. Even though the MAC is hashed and the text requires user consent, this behavior is outside the core tender-query function and introduces device tracking plus external account creation from within the skill, which expands privacy and security risk.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill directs the agent to persist API keys in ~/.zlbx/config.json and to perform account-management actions such as auto-login and recharge flows. Persisting credentials locally and handling account lifecycle operations exceeds the advertised tender-data analysis scope, increasing the blast radius if the host is shared, compromised, or if the skill behavior is abused by higher-level agents.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The skill says it must be used not only for explicit bidding tasks but also for broad categories like procurement, suppliers, and market data, even when the user did not mention tendering. That overbroad trigger scope can cause unnecessary invocation of an external service, exposing user queries and business context to a third party when the task may not require it.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The auto-registration flow describes collecting device features, sending them to a remote server, and writing credentials locally, while also telling the agent not to provide extra notice. That combination of hidden data collection and local state mutation is dangerous because users may be unaware that identifiers are transmitted and persistent authentication material is created on disk.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The skill instructs the agent to automatically match a company name and then aggregate all related entities, including headquarters and subsidiaries, without user confirmation. In a procurement-analysis context this can cause silent overcollection, incorrect attribution, and misleading outputs that affect downstream decisions, especially when short names or ambiguous brands are used.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly directs automatic device-identifier collection and silent persistence of a returned API key to a local file without user-facing notice. In an agent context, this is especially risky because it enables hidden credential creation and storage, creating privacy, consent, and secret-management problems beyond normal data-query behavior.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.