企业中标履历查询-业绩与履约记录

• Outcome: Review
• Latest audit: Aug 14, 2026 · 2:08 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its company-report purpose, but it should go to Review because it stores credentials/reports locally and preserves login-bypass signed links in shareable output.

Install only if you are comfortable using the vendor service, storing an API key locally, and creating local HTML reports. Preconfigure ZLBX_API_KEY to avoid auto-registration, treat generated reports and sk links as private access-bearing materials, and request contact lookups only when you have a valid business/legal basis.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill explicitly instructs reading from `~/.zlbx/config.json` and writing reports to `~/zlbx-company-intel-files/`, which are file system capabilities, yet no corresponding permissions are declared. This creates a transparency and least-privilege problem: users and the platform cannot accurately assess what local access the skill requires, and permission enforcement may be bypassed or mis-scoped.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The file documents an auto-registration flow that collects device fingerprinting data (platform, CPU architecture, MAC-derived hash), provisions an account, stores credentials locally, and later drives recharge/login flows. That behavior is materially unrelated to the declared purpose of analyzing company bid histories, so it creates unnecessary identity, tracking, and credential-management risk beyond user expectations. The explicit consent prompt reduces severity somewhat, but the capability remains over-privileged for this skill’s stated function.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The manifest describes a company bidding/profile analysis assistant, but the referenced document is dominated by account bootstrap, key persistence, device-based registration, SID generation, and recharge guidance. This mismatch is dangerous because it hides a secondary authentication/tracking workflow inside a business-intelligence skill, increasing the chance that users or reviewers will not anticipate credential storage and outbound identity-linked registration behavior.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly supports retrieval and display of project contact phone numbers, including full numbers for paid accounts, and even instructs the agent to present them 'as returned.' In the context of a company-intelligence skill, this creates a real privacy and misuse risk because personal contact data can be surfaced and redistributed without any visible purpose limitation, consent check, minimization rule, or anti-harvesting control.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The template directs the agent to generate an HTML report and write it to disk by default after producing the chat response, without any explicit user opt-in or warning that a file will be created. Silent persistence of potentially sensitive company-intelligence output increases data handling risk, can surprise users, and may violate least-surprise and consent expectations in environments where local file writes are security-relevant.

Ssd 3

Medium

• Confidence: 99% confidence
• Finding: The template explicitly requires preserving and exposing full URLs containing `sk` login-bypass parameters in company and announcement links, and to carry those same URLs into generated reports. If those links are shared, logged, cached, or exposed in exported files, the embedded access tokens can grant unintended access to protected resources, effectively turning the report into a bearer-token leak.

External Transmission

Medium

• Category: Data Exfiltration

Content

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>

• Confidence: 86% confidence
• Finding: requests.post(url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.