全网招标采购与供应商寻源-必联网

• Outcome: Review
• Latest audit: Aug 14, 2026 · 2:45 AM UTC
• Version: 1.0.2

Overview

This skill provides tender-search features, but it also can create an account, fingerprint the device, store an API key locally, and generate auto-login billing links with unclear user control.

Review before installing. Use a preconfigured API key if possible, and do not allow automatic registration unless you are comfortable sending platform, CPU architecture, and a hashed MAC address to the provider and storing an API key under ~/.zlbx/config.json. Treat generated auto-login recharge links as sensitive account links, and use caution with company-contact lookups and broad customer-development searches.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to auto-register an account by collecting device characteristics and then persist the returned API key to disk when no credential is present. That behavior exceeds the stated tender-search purpose, creates an unsolicited account on behalf of the user, and introduces credential-handling and device-fingerprinting risks without explicit consent.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The quota flow directs the skill to generate an auto-login session link for recharge/account access, which expands the skill from data retrieval into account-session brokering. Creating session-bearing links for login can expose users to account hijack, token leakage, or phishing-like flows if the link is mishandled, logged, or shown without adequate warning.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill exposes company project contact information, including phone numbers, which expands from market/tender intelligence into direct personal contact data handling. Even if numbers may be masked for some accounts, this capability can enable unsolicited outreach, profiling, or bulk lead generation beyond the narrowly stated procurement-analysis purpose.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The documentation gives conflicting guidance: one path says to auto-select matched companies without user confirmation, while another says ambiguous candidates must not be chosen automatically. This inconsistency can cause the agent to query or disclose data about the wrong legal entity, creating privacy, accuracy, and authorization risks in downstream analysis.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill adds automatic account registration, API key provisioning, local credential persistence, and session bootstrap logic that materially exceeds its stated procurement/tender search purpose. Even if framed as convenience, this expands the trust boundary by creating accounts and storing secrets on behalf of the user, which can surprise users and create unauthorized state changes outside the core search function.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill instructs collection of device fingerprints (platform, architecture, and a hashed MAC address) for trial deduplication, which is unrelated to tender search and creates a persistent cross-session identifier. Hashing the MAC does not eliminate the privacy risk because it still serves as a stable device identifier and is transmitted to a third party.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill includes quota exhaustion handling that generates login/payment links and encourages phone binding to obtain additional credits, which is outside the manifested search functionality. This creates hidden commercial/account-management behavior and may pressure users into identity-linked actions unrelated to the immediate task.

Vague Triggers

High

• Confidence: 88% confidence
• Finding: The trigger conditions are extremely broad, stating the skill must be used for a wide range of procurement, supplier, customer-development, and competitor-analysis topics even when the user does not mention the platform. Overbroad activation increases the chance the skill is invoked in unrelated contexts, causing unnecessary credential access, network calls, and exposure to the risky auto-registration/account flows described elsewhere in the file.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill describes collecting device data and writing an obtained API key into a local config file without any user-facing disclosure or consent step. Silent fingerprinting and credential persistence are dangerous because they create privacy risk, unexpected state changes on the host, and long-lived secrets on disk that may be reused or exfiltrated later.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the model to automatically match ambiguous short company names and run downstream queries without confirmation. In a business-intelligence context, this can silently widen scope to subsidiaries or unrelated entities, leading to over-collection and potentially incorrect or unauthorized profiling of companies.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The instructions explicitly tell the agent to silently gather device identifiers, proceed even if collection partly fails, auto-register, and persist the resulting credential for future sessions. In the context of a tender-search assistant, this is especially dangerous because the behavior is unrelated to the user's immediate task and normalizes covert data collection plus persistent authorization changes on the local system.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.