Security audit

招投标大数据聚合分析-中招联合

Security checks across malware telemetry and agentic risk

Overview

The skill is a real bid-data analytics integration, but its first-use flow can create an external account, send a stable device-derived identifier, and store an API key locally with unclear user control.

Install only if you are comfortable with this provider creating or recovering a trial account when no API key is configured, collecting a hashed MAC-derived device identifier for deduplication, storing an API key in ~/.zlbx/config.json, and possibly exposing bid-project contact details through paid account features. Prefer configuring your own API key explicitly and avoid auto-registration unless you accept those side effects.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill is presented as a bid-data analytics assistant, but it also performs account lifecycle actions: automatic registration, local credential persistence, and login/recharge handling. That is a scope expansion unrelated to analytics and can lead to silent identity creation, secret storage, and external account linkage without clear user intent or consent.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The documented auto-registration flow collects device fingerprint attributes such as platform, architecture, and a MAC-derived hash, even though the stated function is tender/bid analytics. Device fingerprinting enables tracking and account binding beyond what is necessary for the service, and the instruction to continue even when collection partially fails suggests stealthy best-effort identification rather than transparent consent-based auth.

Context-Inappropriate Capability

Low

Confidence: 89% confidence
Finding: The recharge path generates an auto-login SID and sends the user to a login/payment URL, which extends the skill into session-brokering for account access. While lower severity than silent registration, this can still create phishing-like trust confusion and unnecessary credential/session handling in a skill whose purpose is data analysis.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The project contact lookup API exposes named individual contacts and phone numbers, which is materially outside a bidding-statistics and trend-analysis skill. This enables collection of personal contact data under the cover of market analytics, creating privacy, misuse, and unauthorized outreach risks.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Access to individual phone data is not justified by the skill’s stated analytics use case and creates a direct personal-data exposure path. Even masked numbers can facilitate lead generation, profiling, or attempted reidentification, especially when combined with names, project context, and bid history.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The document defines a full auto-registration, credential provisioning, persistence, and upsell workflow that materially exceeds the skill's declared bidding-data analytics purpose. Even with a stated consent gate, it instructs the agent to collect device-derived identifiers, contact a remote service, create or recover accounts, persist API keys locally, and generate login/recharge links, which expands the trust boundary and creates privacy and account-management risk unrelated to the user’s requested analysis task.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill instructs the agent to collect platform, architecture, and a hashed MAC-derived identifier for trial-account deduplication, which is device fingerprinting and not necessary for the declared analytics purpose. A SHA256 hash of a MAC address is still a stable pseudonymous identifier that enables cross-session/device tracking and external correlation, especially when combined with other metadata and transmitted to a third-party service.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The instructions direct the agent to write API keys into ~/.zlbx/config.json and merge config state automatically, which is beyond the analytics-only scope and introduces local secret-handling risk. Local persistence of credentials can expose secrets to other local processes, backups, or users if file permissions are weak, and it creates durable side effects the user may not expect from a data-analysis skill.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The recharge and auto-login SID generation flow adds account upsell and session-bootstrap functionality unrelated to tender analytics, expanding the skill into authentication and billing operations. Generating auto-login links from an API key increases the blast radius of compromised local credentials and could facilitate unauthorized account access if the key or generated SID is exposed.

Vague Triggers

High

Confidence: 95% confidence
Finding: The trigger condition is extremely broad, effectively claiming any request involving bidding statistics, market analysis, trends, or Top rankings must use this skill. Overbroad routing increases the chance of unintended activation, causing unnecessary data sharing to this provider and making users less aware that an external service is being engaged.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill describes automatic device-feature collection, network registration, and writing an API key to a local config file, while also instructing the system not to give extra prompts. That combination removes informed consent around sensitive operations involving identifier collection, external account creation, and persistence of credentials on disk.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documented behavior automatically expands a user’s query from one company name to multiple related legal entities and performs follow-on queries without confirmation. That can silently broaden data collection and analysis scope, producing overcollection, inaccurate attribution across affiliates, and user surprise about which entities were queried.

Ssd 3

High

Confidence: 99% confidence
Finding: This is a direct privacy and security issue: the skill silently collects device identifiers, registers an account, and persists an API key without meaningful disclosure. In the context of an analytics assistant, those hidden side effects are especially dangerous because users would reasonably expect data querying, not background identity creation and tracking.

External Transmission

Medium

Category: Data Exfiltration
Content: > ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串 > > 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`， > 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`** > （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。 >
Confidence: 78% confidence
Finding: requests.post(url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.