Security audit

知了标讯官方招投标助手

Security checks across malware telemetry and agentic risk

Overview

This skill is a procurement-data assistant, but it also provisions accounts, sends a hardware-derived device identifier to the provider, stores an API key locally, and can generate an auto-login recharge link.

Install only if you are comfortable with the provider creating or reusing a trial account, receiving a MAC-derived device hash, and storing an API key under ~/.zlbx/config.json. Prefer setting your own ZLBX_API_KEY manually if you want to avoid the automatic registration path, and avoid sharing generated auto-login recharge links in public or shared chats.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill directs the agent to automatically register an account when no API key is present by collecting device-derived identifiers and sending them to a remote service, then persisting the returned credential locally. That exceeds the expected scope of a tender-query assistant and creates unauthorized account creation, privacy, and secret-handling risks without explicit user consent.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The documented flow generates an auto-login recharge link tied to the current API key/session, which moves the skill beyond data retrieval into account/session management. If mishandled, such links can expose account access or facilitate unauthorized billing actions, especially if surfaced or logged in shared contexts.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The file defines an automatic account-registration, device-identification, and login-enablement workflow that is not necessary for the core tender search/analysis capability. Even with disclosure text and a consent gate, this expands the skill’s privileges into account lifecycle management and remote enrollment, creating unnecessary privacy and security risk if the agent misfires, the prompts are ignored, or the remote service is compromised.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill instructs collection and transmission of device fingerprinting attributes, including a SHA256 hash of the MAC address, to control duplicate free-trial accounts. Although the raw MAC is not sent, the resulting hash is still a persistent pseudonymous device identifier that enables cross-session tracking and account linkage, which is risky and unrelated to tender-data analysis.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The documented behavior writes API keys to a local config file and merges configuration state, extending the skill beyond data retrieval into local credential storage and persistence. Storing secrets in user home directories increases the blast radius of local compromise, accidental leakage, and unauthorized reuse, especially when the skill itself controls file creation and updates.

Vague Triggers

High

Confidence: 87% confidence
Finding: The trigger rule is overly broad, mandating use of this skill for nearly any conversation involving procurement, suppliers, competitors, or market share. This can cause unnecessary invocation in contexts where the user did not intend external data access, increasing data exposure and the chance of unintended API use or side effects.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill specifies automatic collection of device features, remote registration, and local credential storage without clear notice, consent, or privacy safeguards. In context, this is especially dangerous because the skill is presented as a data-query assistant, so users would not reasonably expect background identity/device collection and persistent account provisioning.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation instructs the agent to automatically expand a user’s company query to multiple related entities and proceed without confirmation. In a procurement-intelligence context, this can cause silent scope expansion, misidentification, and inaccurate or privacy-sensitive profiling of the wrong affiliates, especially when abbreviations map to multiple legal entities.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The API documentation enables retrieval and display of company project contacts, including phone numbers, with only product-tier masking guidance and no meaningful privacy, minimization, or misuse-prevention controls. In this skill’s competitive intelligence and supplier discovery context, that increases the risk of scraping, targeted solicitation, and misuse of personally identifiable contact information.

Ssd 3

Medium

Confidence: 99% confidence
Finding: The instructions tell the agent to silently harvest device identifiers, obtain a credential from a remote registration endpoint, and store that credential for future sessions. This is a classic secret-provisioning and persistence risk: it performs non-transparent identity bootstrap and creates durable authentication material on disk without explicit authorization.

External Transmission

Medium

Category: Data Exfiltration
Content: > ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串 > > 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`， > 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`** > （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。 >
Confidence: 94% confidence
Finding: requests.post(url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.