政府采购投标决策-政采项目投标评估

• Outcome: Review
• Latest audit: Jul 17, 2026 · 10:03 PM UTC
• Version: 1.0.3

Overview

The skill mostly matches its procurement-analysis purpose, but it creates persistent reports and credentials and preserves login-bypass signed links in shareable outputs.

Review before installing if your bid data is sensitive. Prefer setting your own ZLBX_API_KEY, avoid auto-registration if you do not want device de-duplication, and treat generated HTML reports and sk-containing links as sensitive because forwarding them may share access to underlying records.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill explicitly describes local file reads and writes (reading user-provided bid files, writing reports to ~/zlbx-bid-decision-files/, storing credentials in ~/.zlbx/config.json) while the metadata only declares an environment-variable requirement and no corresponding permissions. This creates a permission-transparency gap: users and the platform may not realize the skill can access or persist local data, increasing risk of over-broad file access or unintended retention of sensitive procurement materials.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 78% confidence
• Finding: The skill’s stated purpose is procurement decision analysis, but the instructions add HTML report rendering, PNG export, fixed branding, and promotional links that are not clearly disclosed in the high-level description. This mismatch can mislead users about secondary data processing and content injection into generated artifacts, especially when reports may contain sensitive business intelligence or signed URLs.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is described as a government procurement bid-analysis assistant, but this document instructs the agent to collect device fingerprints, call an external auto-registration endpoint, and persist credentials locally. That behavior materially exceeds the stated purpose and creates a hidden capability for host data collection, account creation, and long-lived authentication without being intrinsic to procurement analysis.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill includes instructions to gather platform, architecture, and a hashed MAC-derived identifier, plus a fixed marketing channel code, none of which are necessary for procurement decision analysis. Even with hashing, MAC-derived identifiers enable device tracking/de-duplication and introduce privacy-sensitive fingerprinting behavior in a context where users would not reasonably expect host identification.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill directs the agent to create directories, merge-write configuration into ~/.zlbx/config.json, and store an API key for future sessions. For a nominal analysis assistant, silently modifying local configuration and persisting credentials expands the trust boundary and can leave long-lived secrets on disk without the user understanding the security consequences.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The template explicitly instructs the agent to preserve and display full signed URLs containing the `sk` parameter, describing them as a way to bypass a login wall. Exposing bearer-style signed links in user-facing markdown and exported artifacts can leak access-granting tokens, enable unintended sharing, and extend access beyond the intended recipient or session.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The skill instructs the agent to generate a shareable HTML report file on local disk by default after producing the conversational answer. This expands behavior from analysis into persistent artifact creation, which can unintentionally retain sensitive procurement analysis, expose filesystem paths, and increase the chance of unauthorized sharing or later disclosure.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Writing an HTML report to disk by default without warning creates a silent persistence and disclosure risk. The report may contain sensitive business intelligence, and revealing the absolute local path discloses environment details while making it easier for the file to be accessed, copied, or mishandled.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The instructions require retaining signed `sk` parameters specifically because they bypass login restrictions, but provide no warning that these act like sensitive access tokens. Embedding such links in report text and JSON/HTML exports normalizes credential-like token leakage and increases the blast radius if the report is forwarded or stored.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.