Security audit

竞对情报分析-投标对手底细摸排

Security checks across malware telemetry and agentic risk

Overview

The skill is a real competitor-intelligence integration, but it asks for device fingerprinting, local credential persistence, personal contact lookup, and shareable tokenized reports that users should review carefully before installing.

Install only if you are comfortable with this vendor receiving company search terms and a consented hashed device identifier for automatic trial setup, and with the skill storing an API key and reports on disk. Treat exported HTML reports as sensitive because they may contain contact details and tokenized platform links that should not be broadly forwarded.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 79% confidence
Finding: The skill explicitly instructs local reads from ~/.zlbx/config.json and writes reports to ~/zlbx-company-intel-files/, but the finding says no corresponding permissions are declared. That creates a transparency and sandboxing problem: an agent may perform filesystem access the platform or user did not clearly authorize, including reading local credential material and persisting files unexpectedly.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 82% confidence
Finding: The skill is described as competitor-intelligence analysis, but it also includes behavior to render standalone HTML reports, add branded marketing/upsell content, and support browser-side export features. This mismatch can mislead users and reviewers about what the skill actually does, increasing the chance that extra content generation, tracking links, or unreviewed client-side behavior is executed under the guise of analysis.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill documents a tool that retrieves project contact names and phone numbers, including full numbers for paid accounts, in a competitor-intelligence workflow where such personal contact access is not clearly necessary for the stated purpose. In this context, the feature materially increases the risk of privacy abuse, targeted solicitation, and misuse of personal data gathered under the guise of bid analysis.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The document instructs the agent to perform an automatic registration flow, collect device-derived identifiers, transmit them to a remote service, and persist returned credentials locally. That behavior materially exceeds the stated purpose of a competitor-intelligence analysis skill and creates an unnecessary trust boundary expansion, privacy risk, and credential-handling surface unrelated to the user-requested analysis task.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The skill directs collection of platform, architecture, and a hashed MAC address to create a stable device identifier for trial deduplication. Even if the raw MAC is not transmitted, the hashed value is still a persistent device fingerprint, and collecting it from the local system is unrelated to competitor analysis and increases privacy and tracking risk.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The instructions tell the agent to write an API key to ~/.zlbx/config.json and merge it into local configuration for future reuse. Persisting credentials on disk from within an analysis skill is unnecessary for the declared function and increases exposure to local compromise, accidental reuse, and cross-context secret leakage.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill includes instructions to generate device-based auto-login and recharge links when quota is exhausted. This introduces account-management and authentication-link issuance behavior unrelated to analysis, and could facilitate session-link abuse or social engineering if surfaced in the wrong context.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The template instructs the agent to create a local HTML file by running a Python script and then reveal the absolute filesystem path to the user. That exceeds the core purpose of producing a report in-chat, introduces unnecessary local side effects, and can leak environment details such as usernames, directory structure, or storage conventions that may aid further probing or abuse.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The template repeatedly requires preserving and outputting full URLs containing `sk` login-bypass parameters, including in company and announcement links. Embedding and propagating bearer-like access parameters in generated reports can disclose transferable access to privileged pages, especially when the report is shared, forwarded, logged, or exported to HTML.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The documentation instructs the agent to send company/query data and API credentials to an external remote service but does not mention this data transfer to the user or require consent. This creates a transparency and privacy risk because users may provide sensitive company names, competitive targets, or query terms without understanding they are being transmitted off-platform.

Missing User Warnings

High

Confidence: 94% confidence
Finding: The contact lookup capability exposes personal contact data, including phone numbers and partially identified names, and even instructs the agent to display numbers exactly as returned. In a competitor-analysis skill, this meaningfully elevates privacy and misuse risk because it enables direct outreach, profiling, or harassment of individuals connected to procurement activity without any clear warning, consent, or purpose limitation.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill mandates inclusion of login-bypass `sk` links and even encourages sharing an HTML version, but provides no warning that these links may grant access to gated content if redistributed. In this context, the omission materially increases the chance of accidental credential-like link sharing and unauthorized downstream access.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script intentionally renders and saves self-contained HTML reports that include direct company-page links carrying access tokens ('sk') and contact details. Because the output is designed for offline opening, printing, and forwarding, recipients may unknowingly redistribute bearer-style links and sensitive business intelligence beyond the intended audience, causing access leakage and privacy exposure.

External Transmission

Medium

Category: Data Exfiltration
Content: > ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串 > > 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`， > 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`** > （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。 >
Confidence: 88% confidence
Finding: requests.post(url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.