医疗器械投标决策-医院采购投标评估

• Outcome: Review
• Latest audit: Jul 17, 2026 · 10:03 PM UTC
• Version: 1.0.3

Overview

The skill performs the advertised bid analysis, but it also fingerprints the device for account registration, stores an API key locally, and preserves signed access links in generated reports.

Review before installing. Prefer configuring your own API key manually, and install only if you are comfortable with the vendor receiving query terms plus a consent-gated device hash for free-trial registration, with an API key stored in your home directory and HTML reports saved locally. Avoid exporting or sharing reports that contain signed access links unless you intend those links to be usable by recipients.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill explicitly describes local file reads of user-provided tender files and local writes of generated reports, while the metadata only declares an environment-variable requirement and no corresponding permissions. This creates a transparency and policy-enforcement gap: users and platforms may not realize the skill can access local files, weakening consent and sandbox controls.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 80% confidence
• Finding: The declared purpose is bid-decision analysis, but the skill also performs report rendering/export and embeds branding/promotion links in the generated artifact. This broader behavior is not inherently malicious, but it increases attack surface and can mislead users about what the skill actually produces and where data may flow, especially when generated HTML may contain external links or active content.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file defines an automatic registration, device fingerprint collection, remote account provisioning, and credential persistence workflow that is unrelated to the declared purpose of a medical bidding analysis skill. Even though it asks for consent and limits fields, this is still hidden capability expansion: a user invoking a procurement-analysis skill would not reasonably expect local hardware-derived identifiers to be collected and a third-party account to be created.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This section instructs the agent to collect platform, CPU architecture, and a MAC-derived hash by executing host inspection commands across macOS, Linux, and Windows. In the context of a medical tender analysis skill, device fingerprinting is out of scope and dangerous because it enables persistent device tracking, expands local-environment access, and normalizes collection of host identifiers under a misleading business function.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The skill instructs writing an API key to ~/.zlbx/config.json and reusing it in future sessions, creating a persistence mechanism on the local machine. For a skill advertised as bid-decision analysis, silent credential storage materially increases risk because it establishes lasting authorization state, can overwrite or merge into local config unexpectedly, and broadens the blast radius if the skill or surrounding environment is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The quota-exhaustion flow generates a device SID and directs the user to an auto-login and recharge URL, which is unrelated to the stated analytical purpose of the skill. While less severe than fingerprinting or credential persistence, it still embeds account lifecycle and monetization behavior into a domain skill, increasing phishing-like trust abuse and encouraging the agent to facilitate external account actions beyond expected scope.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The template explicitly requires preserving and sharing full signed URLs containing the `sk` parameter and describes that parameter as bypassing a login wall. That is effectively distribution of reusable bearer-style access tokens to end users, which can enable unauthorized access, uncontrolled sharing, and leakage via logs, chat transcripts, browser history, referrers, or copied reports.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The template instructs the agent to automatically generate a shareable HTML file on local disk by default after producing the report in chat. Persisting potentially sensitive procurement analysis and embedded signed URLs to a predictable filesystem location increases the risk of data exposure through local file access, backups, multi-user environments, later reuse, or accidental sharing.

Vague Triggers

High

• Confidence: 92% confidence
• Finding: The activation rule says the skill must be used even when the user does not mention 'medical' as long as the request involves hospital procurement analysis. Overly broad triggering can cause the agent to invoke this skill in unrelated or ambiguous contexts, leading to unnecessary external API calls, unintended data disclosure, and user confusion about why a specialized third-party service was used.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The workflow explicitly instructs the agent to read a user-provided local tender file and parse it, but provides no user-facing disclosure, consent boundary, or restriction on what paths/files may be accessed. In an agent setting, "read local file" behavior can be abused to induce unintended access to sensitive local data, especially if the user input is ambiguous or if the runtime has broader filesystem visibility than expected.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.