Security audit

信创与IT信息化采招分析-数字政府国产化选型情报

Security checks across malware telemetry and agentic risk

Overview

The skill is mainly a procurement-analysis helper, but its default onboarding path can create an external account, fingerprint the device, persist a credential locally, and generate account login links in ways users should review first.

Review this skill before installing if you do not want an agent to create a third-party account, send a hashed device identifier, store an API key under ~/.zlbx/config.json, or generate account login/recharge links. Prefer manually setting ZLBX_API_KEY and avoid auto-registration unless you accept the device-deduplication and local credential persistence behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill instructs the agent to automatically create an external account and store the returned API key in a local config file when no credential is present. That exceeds the stated purpose of procurement-data analysis, introduces unauthorized outbound account creation, and causes persistent credential writes on the host without explicit user consent.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: Collecting device characteristics such as platform, architecture, and a MAC-derived hash to register an account is a form of device fingerprinting unrelated to normal bid-analysis functionality. It creates unnecessary privacy risk and can uniquely bind the host to a third-party service, especially because failures are silently tolerated and the flow continues automatically.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill can request a device SID and emit an auto-login recharge link tied to the current API key, effectively facilitating account access/session bootstrapping beyond procurement analysis. This expands the skill into account-management behavior and could expose users to unintended authentication flows or misuse of a provisioned account.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: This file documents account-balance and daily-consumption capabilities that are unrelated to the stated procurement-analysis purpose of the skill, creating a scope mismatch. Exposing or invoking out-of-scope account tooling can let users query billing and usage metadata for the bound API account, increasing the attack surface and enabling unauthorized information disclosure about account status and consumption patterns.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The `get_company_contacts` capability exposes project contact details, including names and phone numbers, which are personal contact data and can enable unsolicited outreach, profiling, or targeted social engineering. Although the documentation mentions masking for lower-tier accounts, the feature still goes beyond high-level procurement analysis and creates a direct path to sensitive person-level data access.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This document introduces a full auto-registration, device fingerprinting, credential persistence, and account lifecycle flow that is unrelated to the stated procurement-analysis purpose of the skill. That scope expansion is dangerous because it enables collection of host-derived identifiers and remote account creation under the guise of a data-analysis assistant, increasing privacy and supply-chain risk if the skill is invoked in broader contexts.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The documentation instructs the agent to collect device characteristics (platform, architecture, MAC-derived hash), transmit them to an external service, persist returned API keys locally, and manage recharge/login flows. For a procurement-analysis skill, these capabilities are unnecessary and materially increase the attack surface by normalizing fingerprinting, external data transmission, and local secret handling within a non-authentication feature.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The prose requires user consent before any collection or registration, but the pseudocode shows an auto-register branch that proceeds directly from missing credentials to collecting features and posting them remotely. This mismatch is dangerous because implementers may follow the pseudocode and silently collect/transmit device-derived data without consent, creating a privacy and compliance violation.

Vague Triggers

High

Confidence: 95% confidence
Finding: The activation rule says the skill must be used for a very broad set of IT, procurement, cloud, software, security, and related requests, even when the user did not mention the core domain. Overbroad triggering increases the chance the agent invokes this skill in unrelated contexts, causing unnecessary data sharing with the external service and unexpected credential/account flows.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill directs the agent to collect device data, call an external registration endpoint, and write an API key to ~/.zlbx/config.json without warning the user about privacy implications or local state changes. Hidden persistence and undisclosed transmission are dangerous because users may not realize credentials are being created, stored, and reused across sessions.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The documentation instructs the system to automatically expand a user-supplied company reference to multiple related entities and continue with follow-on queries without confirmation. This can cause over-collection and analysis of data about affiliates or subsidiaries the user did not explicitly request, increasing privacy, accuracy, and authorization risks.

External Transmission

Medium

Category: Data Exfiltration
Content: > ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串 > > 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`， > 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`** > （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。 >
Confidence: 95% confidence
Finding: requests.post(url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.