供应商资质核查-履约能力一查便知

• Outcome: Review
• Latest audit: Aug 14, 2026 · 2:03 AM UTC
• Version: 1.0.1

Overview

The skill does supplier due-diligence work, but installation should be reviewed because it collects a device fingerprint for signup, stores credentials locally, creates shareable report files, and preserves login-signed links.

Install only if you are comfortable with this vendor creating or using a local API key, sending a hashed device identifier during free signup, saving reports locally, and exposing signed platform links in reports; prefer preconfiguring ZLBX_API_KEY and treating generated links/reports as sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill explicitly states it will read local configuration from ~/.zlbx/config.json and write reports to ~/zlbx-company-intel-files/, but only declares an environment-variable requirement and no corresponding file permissions. This creates a permission-model bypass risk: operators and users cannot accurately understand or constrain what local resources the skill may access, increasing the chance of unintended file exposure or modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 79% confidence
• Finding: The skill is presented as a supplier due-diligence tool, but it also performs branded HTML rendering, PNG/PDF export, and inserts fixed marketing/navigation links not reflected in the declared purpose. This mismatch undermines user trust and can be abused to introduce undisclosed content-generation, tracking, or promotional behavior into outputs that may be shared externally as if they were purely analytical reports.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file embeds a full auto-registration and account-bootstrap workflow inside a supplier qualification skill, which is unrelated to the declared purpose of assessing suppliers. This expands the skill's authority from analysis into credential acquisition, local environment inspection, persistence, and account lifecycle handling, creating unnecessary attack surface and increasing the chance of covert data collection or unauthorized external actions.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill instructs collection of device fingerprints (platform, architecture, MAC-derived hash) for trial deduplication even though that data is not needed to perform supplier qualification analysis. Even with hashing, this is still persistent device tracking information that is transmitted externally, and the skill context makes it especially suspicious because procurement review does not justify endpoint fingerprinting.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The instructions add persistent API key storage, balance handling, auto-login link generation, and recharge/phone-binding flows that go beyond the skill's stated analysis role. Persisting credentials locally and driving users into account monetization flows from within the skill increases security and privacy risk, especially if the skill can write config files or influence future authenticated sessions.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The template explicitly requires exposing full URLs with `sk` login-bypass parameters and preserving them when shown to users. If those links are copied, logged, forwarded, or embedded elsewhere, the bearer-style parameter can grant unintended access to protected company pages or deeper data without normal authentication.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The template mandates writing report data to a temporary file and running a local Python script to generate HTML as a default behavior, even when the user only asked for a report. This expands the skill's side effects, creates local artifacts containing potentially sensitive business intelligence, and introduces execution and storage risk beyond the core conversational task.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly supports retrieving and displaying project contact phone numbers, including full numbers for paid accounts, and instructs the agent to present them verbatim. In a supplier due-diligence context, this creates a real privacy and data-protection risk because personal contact data may be exposed to users without any stated purpose limitation, consent check, minimization rule, or user-facing warning.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill directs the agent to create local files and persist report content without first warning the user or obtaining consent. Because the reports concern supplier due diligence and may include sensitive relationship, risk, and contact information, silent file creation can expose data through local disk retention, backups, or multi-user environments.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Requiring preservation of `sk` login-bypass parameters in shared links without any privacy or sensitivity warning encourages unsafe dissemination of bearer-style access URLs. Users may reasonably treat them as ordinary links and share them broadly, unintentionally disclosing gated enterprise data or contact information to unauthorized parties.

External Transmission

Medium

• Category: Data Exfiltration

Content

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>

• Confidence: 92% confidence
• Finding: requests.post(url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.