Security audit
Security checks across malware telemetry and agentic risk
This skill analyzes transit procurement data, but it also creates a third-party account using device-derived identifiers and stores credentials locally, so it needs review before installation.
Install only if you are comfortable with the skill using an external Zhiliaobiaoxun service, creating a trial account after consent when no API key is present, sending a hashed device identifier for trial deduplication, and storing the returned API key in ~/.zlbx/config.json. To avoid auto-registration, configure ZLBX_API_KEY yourself before use and review company-matching results when exact legal-entity scope matters.
> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串 > > 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`， > 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`** > （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。 >
VirusTotal findings are pending for this skill version.
No suspicious patterns detected.
