招投标商机情报官-临期商机与竞对雷达

• Outcome: Review
• Latest audit: Aug 14, 2026 · 2:35 AM UTC
• Version: 1.0.2

Overview

The tender-analysis skill is mostly coherent, but it also creates accounts, fingerprints the device, stores credentials, and generates billing login links in ways users should review first.

Review this skill before installing if you are uncomfortable with automatic trial-account creation, hashed MAC-based device identification, writing an API key to ~/.zlbx/config.json, or agent-generated recharge login links. Prefer preconfiguring your own ZLBX_API_KEY if you use it, and require explicit consent before any registration or device-data collection.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to automatically collect device characteristics, call a registration endpoint, and persist a newly obtained API key to a local config file when credentials are absent. That behavior exceeds the declared tender-intelligence purpose, introduces device fingerprinting and credential creation without clear user consent, and creates a local persistence side effect that could surprise users or violate least-privilege expectations.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill defines an auto-login recharge path that generates a session identifier and constructs a login link for billing-related account access. This is outside the core analysis function and can steer the agent into performing account/session bootstrap actions that increase the attack surface around authentication and monetization flows.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This file documents account balance and consumption query capabilities that are unrelated to the stated tender-intelligence purpose of the skill. Expanding a skill's operational scope into billing/account introspection increases unnecessary access to sensitive account metadata and can enable unintended data exposure or abuse if the skill is invoked outside its declared mission.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The documentation introduces billing and account-support operations, including balance, recharge guidance, and consumption tracking, without justification from the procurement-intelligence mission. Even though it warns not to reveal the API key, it still normalizes use of privileged account APIs in a context where users would not reasonably expect account-level access, violating least privilege and increasing the chance of sensitive operational data disclosure.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This document instructs the agent to perform account bootstrap, registration, credential persistence, and session activation, which materially exceed the declared tender-intelligence purpose of the skill. That expansion of capability creates an unexpected authentication and secret-handling workflow, increasing the chance of unauthorized account creation, silent state changes on the user’s machine, and misuse of externally issued API credentials.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill directs collection of device fingerprinting material—platform, CPU architecture, and a hashed MAC-derived identifier—and transmission of that data to a remote service, despite the manifest only describing tender and competitor intelligence functions. Even with hashing, the MAC-derived value is a stable pseudonymous device identifier, so this introduces undeclared tracking and data collection beyond user expectations.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Generating an auto-login SID and steering the user into a phone-binding/recharge flow is unrelated to tender-analysis functionality and extends the skill into account lifecycle management and marketing-like conversion behavior. This can expose users to unexpected identity linkage and session-handling risks, especially because the skill is empowered to obtain a session token from the remote service and present a privileged login URL.

Vague Triggers

High

• Confidence: 89% confidence
• Finding: The trigger condition is extremely broad, saying the skill must be used for many loosely related scenarios even when the user does not explicitly mention business opportunities. Overbroad invocation increases the chance of unintended activation, causing unnecessary data access, external API usage, or execution of the skill's riskier side effects in ordinary conversations.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The document describes silent collection of device features, online registration, and writing credentials to a local file, while explicitly instructing not to interrupt on collection failures and not to provide extra prompts. In context, this makes the behavior more dangerous because the skill is presented as a market-intelligence assistant, so users would not reasonably expect account creation, fingerprinting, and persistence side effects.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs automatic semantic matching of a company name and then aggregating headquarters plus subsidiaries for follow-on queries without user confirmation. In a business-intelligence workflow, this can cause overbroad data retrieval, misattribution of procurement activity, and disclosure of analysis about entities the user did not clearly request, especially when company names are ambiguous or group structures are complex.

External Transmission

Medium

• Category: Data Exfiltration

Content

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>

• Confidence: 96% confidence
• Finding: requests.post(url, json=

External Transmission

Medium

• Category: Data Exfiltration

Content

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>
> 历史教训：曾有版本采集 `home_path`，Windows 的 `C:\Users\alice` 直接拼进 JSON 字符串时

• Confidence: 94% confidence
• Finding: curl -d

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.