企业投标决策智能助手

• Outcome: Review
• Latest audit: Aug 14, 2026 · 2:20 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent bidding-analysis tool, but it also performs account onboarding, device fingerprinting, credential persistence, local report generation, and signed-link exposure that users should review before installing.

Install only if you are comfortable with this vendor receiving project and company query terms, using a device-derived hash for free-trial deduplication when no API key is configured, storing an API key under ~/.zlbx/config.json, creating report files locally, and including signed platform links in generated reports. Prefer configuring your own ZLBX_API_KEY and avoid sharing generated reports if their links contain sensitive sk parameters.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill describes local file reads and report writes, but only declares an environment-variable requirement and no explicit permissions model for filesystem access. This weakens user visibility and platform enforcement around what local resources the skill may touch, increasing the chance of unintended file access or persistence beyond user expectations.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill asks users to provide bidding files while also claiming local file contents are not uploaded, yet it does not document how file-based analysis is performed without transmitting content. This creates a data-handling ambiguity that can mislead users about confidentiality and result in sensitive procurement documents being processed or exfiltrated contrary to expectations.

Context-Inappropriate Capability

Low

• Confidence: 79% confidence
• Finding: Forcing disclosure of an absolute local filesystem path in user-facing output can leak host-specific information such as usernames, directory structures, or organizational naming conventions. In shared chats, screenshots, or logs, this unnecessarily exposes local environment details unrelated to the bidding-analysis result.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file defines an automatic registration and account-management workflow, including device-feature collection, remote registration, quota handling, and auto-login link generation, which materially exceeds the declared bidding-analysis purpose of the skill. That expansion of capability increases privacy and security risk because the agent is instructed to access local environment/config state, derive a device fingerprint, transmit it to a third party, and persist returned credentials on disk.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill instructs the agent to collect platform, CPU architecture, and a hashed MAC address to deduplicate trial accounts, which is a form of device fingerprinting unrelated to bid-decision analysis. Even though the MAC is hashed, it remains a stable device-derived identifier suitable for tracking and linkage, making the privacy risk real rather than hypothetical.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The file directs the agent to inspect local credential sources such as an environment variable and a config file, then later persist an API key into a user config path. Reading and writing credentials is sensitive account-management behavior outside the skill's stated analysis role, and persistent storage raises the risk of unintended credential exposure or unauthorized reuse by other tools or sessions.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The document states that no collection or registration may occur before the user consents, but the provided pseudocode omits that gate and proceeds directly from missing key detection to feature collection and POSTing to the auto-register endpoint. In practice, such inconsistencies are dangerous because implementers or LLMs may follow the pseudocode path and perform unauthorized data collection and account creation.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The template explicitly requires preserving and returning full signed URLs with the `sk` parameter and frames that parameter as a login-bypass mechanism. Exposing bearer-like signed access tokens to end users or downstream systems can bypass normal authentication controls, enable unauthorized sharing, and leak access beyond the intended recipient or session.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The template mandates local script execution and HTML file generation as a default post-processing step, expanding the skill from text generation into filesystem and process execution behavior. This increases attack surface and can create unintended local artifacts, unsafe path handling risks, and side effects unrelated to the user's explicit request.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The markdown directs the agent to create a local HTML file and disclose its absolute path without prior warning or consent. Even if not directly exploitable as code execution, this is an unsafe side effect because it performs local file creation by default and reveals environment-specific filesystem details to the user.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The template requires exposing raw signed access parameters in URLs returned to users, and specifically prohibits removing them because they bypass a login wall. This is a direct leakage of sensitive access material that can be copied, forwarded, logged, or indexed, enabling unauthorized access and weakening access-control boundaries.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.