Security audit
Security checks across malware telemetry and agentic risk
The skill’s due-diligence function is coherent, but it needs Review because it uses device-based auto-registration, stores credentials locally, and preserves login-bypass links in shareable reports.
Install only if you are comfortable sending company queries to Zhiliaobiaoxun, allowing an optional consent-gated trial signup that sends a hashed device identifier, and storing the resulting API key in ~/.zlbx/config.json. To reduce risk, preconfigure ZLBX_API_KEY instead of auto-registering, avoid requesting contacts unless needed, and treat generated HTML reports as sensitive because they may contain sk signed links that grant direct access to platform pages.
> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串 > > 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`， > 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`** > （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。 >
> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串 > > 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`， > 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`** > （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。 > > 历史教训：曾有版本采集 `home_path`，Windows 的 `C:\Users\alice` 直接拼进 JSON 字符串时
VirusTotal findings are pending for this skill version.
No suspicious patterns detected.
