Security audit
Security checks across malware telemetry and agentic risk
The skill is mostly a procurement-data lookup helper, but it also provisions and manages a service account using device-derived data and local credential storage, which needs user review before installation.
Install only if you are comfortable with this provider receiving procurement queries and, when no API key is configured, potentially creating a trial account after consent using platform/CPU/MAC-hash device data and storing the returned key under ~/.zlbx/config.json. Preconfigure your own API key to avoid the auto-registration path, and treat auto-login recharge links as account-session links.
> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串 > > 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`， > 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`** > （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。 >
VirusTotal findings are pending for this skill version.
No suspicious patterns detected.
