Security audit

全国采购与招标信息总库-中国采购与招标网

Security checks across malware telemetry and agentic risk

Overview

This procurement data skill is mostly coherent, but it includes broad automatic routing plus account registration that collects a hashed device identifier and stores an API key locally.

Install only if you are comfortable with this provider receiving procurement queries and, on first use without an API key, with an opt-in registration flow that sends platform/CPU/MAC-hash data and stores an API key in ~/.zlbx/config.json. Prefer setting your own ZLBX_API_KEY first, and review company-name expansions and contact lookups before relying on or exporting results.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill embeds a full auto-registration, account creation, quota handling, and persistent credential storage workflow that is outside the stated procurement search/analysis purpose. This expands the skill's authority to create remote accounts, transmit device-derived identifiers, and modify local auth state, increasing privacy, consent, and unauthorized account-lifecycle risk if invoked unexpectedly.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The document instructs the agent to collect device fingerprints such as platform, CPU architecture, and a hashed MAC address for deduplication, which is not necessary for answering procurement-analysis queries. Even though the MAC is hashed, it remains a stable device identifier and its collection/transmission broadens tracking capability beyond the skill's declared purpose.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill is instructed to inspect local environment variables and configuration files for API keys and later persist newly obtained keys into the user's home directory. Reading and writing credentials is broader than a procurement-analysis assistant's stated function and creates risk of unintended secret handling, credential persistence, and local state modification without strong separation of duties.

Vague Triggers

High

Confidence: 95% confidence
Finding: The skill’s activation rule is extremely broad, mandating use for nearly any query containing procurement, bidding, supplier, or competitor terms, even when the user did not explicitly request this source. Overbroad routing can cause unintended data exposure to this external service, unnecessary API calls, and user-surprising behavior that bypasses least-privilege principles.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The skill instructs the agent to automatically collect device characteristics, register an account over the network, and store the returned API key locally when no existing credential is found. This creates a hidden credential-provisioning and persistence flow without meaningful user notice or consent, which is dangerous because it transmits device-derived identifiers and modifies local state silently.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documented behavior tells the system to automatically expand a shorthand company name into multiple related legal entities and use all of them for downstream analysis without user confirmation. This can cause over-collection, incorrect attribution, and misleading business intelligence outputs, especially when a shorthand name ambiguously maps to affiliates, subsidiaries, or unrelated similarly named entities.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The contact lookup capability returns project contact names and phone numbers, including full numbers for some account tiers, but the documentation does not frame this as sensitive personal data or set strong usage constraints. Without explicit privacy, purpose-limitation, and anti-harvesting safeguards, the feature could facilitate mass collection of personal contact information for spam, social engineering, or other abuse.

Ssd 3

High

Confidence: 99% confidence
Finding: The instructions explicitly say to collect platform, architecture, and a MAC-derived hash, continue even on partial failure, write the obtained API key into ~/.zlbx/config.json, and avoid additional user prompts. Silent collection of device identifiers plus local credential persistence is a strong privacy and security concern, especially in an agent context where users may not expect account creation or filesystem changes.

External Transmission

Medium

Category: Data Exfiltration
Content: > ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串 > > 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`， > 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`** > （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。 >
Confidence: 89% confidence
Finding: requests.post(url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.