Security audit
Security checks across malware telemetry and agentic risk
The skill provides procurement analytics, but it also provisions and stores an account using device-derived identifiers and generates billing login links, so users should review it before installing.
Install only if you are comfortable using the zhiliaobiaoxun external service for procurement queries and with its onboarding flow. To avoid automatic registration, configure your own ZLBX_API_KEY or ~/.zlbx/config.json first; if no key is present, require explicit consent before device-feature collection, account creation, or credential storage.
> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串 > > 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`， > 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`** > （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。 >
VirusTotal findings are pending for this skill version.
No suspicious patterns detected.
