中标概率分析-投标胜率评估器

• Outcome: Review
• Latest audit: Jul 18, 2026 · 2:25 AM UTC
• Version: 1.0.3

Overview

The skill mostly matches its bid-analysis purpose, but it also creates persistent credentials, collects a device fingerprint for auto-registration, writes shareable reports by default, and preserves signed access links in those reports.

Review before installing. Use a preconfigured ZLBX_API_KEY if possible to avoid auto-registration. Do not approve auto-registration unless you accept transmission of platform, CPU architecture, and a hashed MAC identifier. Treat generated HTML reports as sensitive business documents, especially because they may include signed links that allow access without a normal login.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill explicitly describes local file reads and writes, including reading user-provided bidding files and writing reports to ~/zlbx-bid-decision-files/, while the metadata only declares an environment variable requirement and no permissions model. This creates a transparency and consent gap: users and the platform may not realize the skill accesses the filesystem, which can lead to unintended exposure of local documents or persistent storage of sensitive procurement analysis artifacts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 80% confidence
• Finding: The skill is presented primarily as a bidding win-rate analysis assistant, but it also generates branded HTML reports with embedded assets, truncated citations, sharing-oriented output, and browser-side export features. That extra behavior increases data handling and disclosure risk because sensitive procurement conclusions may be persisted in a polished shareable artifact without being clearly disclosed as part of the core function.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This document defines automatic account creation, device fingerprint collection, remote transmission of those identifiers, and local API key persistence for a skill whose stated purpose is bid-win-rate analysis. That is a clear scope expansion into credential/account lifecycle management and tracking, which creates privacy and security risk if triggered in an agent context, especially because it instructs collecting a stable hardware-derived identifier and storing credentials on disk.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill embeds OS-specific fingerprinting logic, registration API calls, balance handling, and auto-login flows that are unrelated to bid analysis. In the context of an agent skill, these capabilities increase the blast radius by enabling persistent device tracking, silent account provisioning, and credential management behaviors that users would not reasonably expect from a bidding assistant.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The prose states that user consent must be obtained before any collection or registration, but the included pseudocode omits that gate and directly collects device features and calls the registration endpoint when no key is present. In practice, implementers often copy pseudocode, so this inconsistency can lead to unauthorized fingerprint collection and account creation despite the stated privacy promises.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The template explicitly requires exposing full signed URLs containing the `sk` parameter to end users. Signed access tokens are effectively bearer secrets; sharing them broadly can let unintended recipients access protected resources, enable link forwarding outside the intended audience, and undermine authentication or audit controls. The instruction to preserve the parameter verbatim increases the chance of systematic leakage rather than incidental disclosure.

Context-Inappropriate Capability

Low

• Confidence: 91% confidence
• Finding: The skill mandates generating an HTML file on the local filesystem as a default side effect, even when the user only asked for conversational analysis. Writing files outside the chat response can create unintended persistence of potentially sensitive bid-analysis content and reveals a local absolute path, which may disclose environment details and encourage unsafe assumptions about file accessibility or sharing.

Vague Triggers

High

• Confidence: 90% confidence
• Finding: The activation text mandates use of this skill for a very broad range of loosely related bidding questions, including subjective judgments about supplier preference and relationship signals. Over-broad triggering can cause unnecessary transmission of project and company data to external APIs, increase cost-incurring calls, and route users into a workflow that performs more collection and persistence than needed for a simple question.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The instructions introduce a non-obvious side effect: writing a report file and disclosing its absolute path without clear advance warning in the skill description. This can violate user expectations, persist potentially sensitive business intelligence data locally, and expose filesystem layout details that are irrelevant to the analytical task.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The template requires preserving signed `sk` parameters in shared output without warning users that these links may bypass normal login barriers. In the context of a bidding-analysis skill that distributes reports and citations, this materially increases the risk of unauthorized downstream access, accidental resharing, and leakage of vendor or procurement data through bearer-style URLs.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.