企业情报-招投标视角的企业背调

• Outcome: Review
• Latest audit: Aug 14, 2026 · 1:59 AM UTC
• Version: 1.0.1

Overview

The skill does make company background reports, but it also stores account credentials and puts sign-in-bypass links into reports that are meant to be shared.

Review before installing. Use a preconfigured ZLBX_API_KEY if possible, avoid sharing generated reports outside trusted recipients because they may contain sk sign-in-bypass links, and request contact lookups only when you have a legitimate business need for that data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill explicitly instructs the agent to read from and write to local filesystem paths such as ~/.zlbx/config.json and ~/zlbx-company-intel-files/, but the metadata declares only an environment-variable requirement and no corresponding permissions. This creates a capability/permission mismatch: an operator may assume the skill cannot access files when in fact its instructions direct local credential reads and report writes, increasing the risk of unintended local data exposure or unauthorized file modification in permissive runtimes.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The document introduces account auto-registration, API key persistence, and recharge-link generation that are operational/account-management behaviors rather than core company-intelligence analysis. This expands the skill's privilege and data-handling scope, creating unnecessary collection, storage, and outbound account actions that increase privacy and abuse risk if triggered by the agent.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill instructs collection of device fingerprinting data (platform, architecture, MAC-derived hash) and local API key storage, which are not necessary for answering company background questions. Even with hashing and a stated privacy purpose, this still creates a persistent device identifier and credential footprint that can track users across sessions and expose secrets if the local config is read by other processes.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly documents an API that returns project contact phone numbers and instructs the agent to display them as returned, including full numbers for paid accounts. Because this skill is for company intelligence and background investigation, exposing identifiable contact data without stronger purpose limitation, consent checks, minimization, or handling guidance creates a real privacy and data-protection risk and can enable unsolicited outreach or doxxing-style misuse.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The template explicitly requires user-facing links to preserve the full `sk` login-bypass parameter and encourages sharing those links in Markdown and exported HTML. If `sk` acts as a bearer-style access token, exposing it in report content can let anyone who receives, forwards, or logs the report access protected company pages without authentication, and there is no warning to users that the links are sensitive.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The template repeatedly instructs the agent to include original URLs with `sk` parameters in company links, announcement links, JSON used for rendering, and the final shareable HTML report. This directly propagates sensitive access-bearing parameters into natural-language content and generated artifacts, creating a durable token leakage path through chat history, files, screenshots, browser history, referrers, and onward sharing.

External Transmission

Medium

• Category: Data Exfiltration

Content

> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>

• Confidence: 93% confidence
• Finding: requests.post(url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.