招标采购信息智能查询

• Outcome: Review
• Latest audit: Aug 14, 2026 · 2:20 AM UTC
• Version: 1.0.1

Overview

This tender-search skill has coherent search features, but it also directs account creation, device-derived tracking, local credential storage, and auto-login billing flows that require careful review before install.

Install only if you are comfortable with this skill using an external Chinese procurement service, reading or creating ~/.zlbx/config.json, collecting a hashed MAC-derived device identifier for trial account registration, and storing an API key locally. Prefer manually configuring ZLBX_API_KEY and decline auto-registration unless you explicitly want that account and device-binding flow.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill’s stated purpose is procurement search, but it also instructs the agent to perform automatic registration, collect device-derived identifiers, transmit them to a remote service, and persist returned credentials locally. Those behaviors materially exceed the minimum capability needed for search and create unnecessary identity, tracking, and credential-handling risk, especially because the flow is designed to occur silently.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Automatic device-based registration is not justified by the core search function and introduces covert account creation and device correlation. Collecting platform, architecture, and a MAC-derived hash for fallback registration expands the data footprint and enables persistent tracking or unauthorized enrollment without clear user awareness.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: Generating an auto-login recharge link from the API key is outside the narrow purpose of procurement search and creates a credential-adjacent session bootstrap path. If mishandled, such links can enable unintended account access, session fixation, or phishing-style redirection, particularly when surfaced automatically rather than through normal authenticated user flows.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill is scoped and described as a tender/procurement search tool, but this file documents account-balance and usage-consumption APIs that expose billing and account metadata unrelated to the declared user task. This creates scope creep and enables an agent invoking the skill to access sensitive account information without a clear business need, increasing the chance of unintended data exposure and abuse of the configured API credentials.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The file documents broad company-intelligence capabilities that exceed a procurement-search skill’s stated purpose, including registry data, competitor analysis, partners, and contacts. Scope expansion increases the chance that an agent will access or expose sensitive business information beyond user expectations, undermining least-privilege and purpose limitation.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The contact lookup API exposes project contact information, including phone numbers, for named companies. Even with masked output for some account tiers, this capability can facilitate targeted outreach, scraping, or privacy-invasive profiling that is not clearly necessary for basic procurement-search functionality.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The document instructs the agent to perform automatic account creation, persist credentials to disk, and alter future authentication behavior, which materially exceeds the declared procurement-search capability. This expands the skill from search into identity/bootstrap and local credential management, creating unexpected trust and security boundaries for users and agents.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill directs collection of device fingerprint components (platform, architecture, MAC-derived hash) and transmission to a remote service in order to create accounts and enforce device uniqueness. Even with hashing, this is persistent device tracking unrelated to tender search, and it conditions service access on harvesting host-level identifiers from the runtime environment.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill can request a device SID and generate an auto-login recharge link, extending its authority from search into session/bootstrap flows for billing or account access. This creates a secondary authentication artifact that could be abused for unintended account access or social-engineered upsell behavior if surfaced automatically by an agent.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The description says the skill must be used whenever users ask about tenders or procurement information, which is an overly broad mandatory-invocation rule. Overbroad routing increases the chance the agent invokes a skill in contexts where it is unnecessary, causing avoidable external data sharing and exposure to the skill’s risky registration and credential flows.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill describes silent fallback behaviors including local secret lookup, device fingerprint collection, remote transmission, and local credential storage, but explicitly suppresses user-facing notice. Lack of transparency around sensitive operations undermines informed consent and makes potentially privacy-invasive actions much more dangerous in an agent setting.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation instructs the agent to automatically match company names and proceed with follow-on analysis without user confirmation. This can cause over-collection, misidentification of entities, and silent expansion from a single intended company to all affiliates or similarly named subsidiaries, producing privacy and accuracy risks.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The instructions tell the agent to silently gather device features and save an obtained API key for future use, which establishes persistent access without transparent user approval. In an agent environment, undisclosed persistence is dangerous because it changes the trust boundary from a single search request to continuing credentialed access on the host.

Ssd 4

Medium

• Confidence: 95% confidence
• Finding: The skill lays out a staged escalation path: first check environment secrets, then read a local config, then auto-register using device-derived data, and later support auto-login recharge flows while suppressing mention of these behaviors. This layered fallback design increases risk because it normalizes progressively more invasive actions without an explicit trust checkpoint or user acknowledgment.

External Transmission

Medium

• Category: Data Exfiltration

Content

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>

• Confidence: 84% confidence
• Finding: requests.post(url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.