Security checks across malware telemetry and agentic risk
The skill mostly matches its bid-document parsing purpose, but it automatically starts a LAN-accessible background preview server that can expose generated reports and local skill files, so it needs careful review.
Install only if you are comfortable sending tender documents to your configured LLM provider and can run the tool in a restricted environment. Do not use it on confidential bids without disabling or containing the HTTP preview server, binding preview to localhost only, and protecting env_config.md/API keys from LAN exposure. Pin and review dependencies before production use.
kwargs["creationflags"] = subprocess.DETACHED_PROCESS | subprocess.CREATE_NEW_PROCESS_GROUP
else:
kwargs["start_new_session"] = True
proc = subprocess.Popen(cmd, **kwargs)
ip = _get_local_ip()
base_url = f"http://{ip}:{port}"
return proc, base_url# 招标文件解析工具依赖 # PDF 处理 pypdf>=3.0.0 # LLM API 调用 openai>=1.0.0
pypdf>=3.0.0 # LLM API 调用 openai>=1.0.0 # 其他工具 python-dotenv>=1.0.0
openai>=1.0.0 # 其他工具 python-dotenv>=1.0.0 # 结果导出与预�?pandas>=2.0.0 openpyxl>=3.1.0
python-dotenv>=1.0.0 # 结果导出与预�?pandas>=2.0.0 openpyxl>=3.1.0 weasyprint>=60.0 reportlab>=4.0.0 qrcode>=7.4
# 结果导出与预�?pandas>=2.0.0 openpyxl>=3.1.0 weasyprint>=60.0 reportlab>=4.0.0 qrcode>=7.4
# 结果导出与预�?pandas>=2.0.0 openpyxl>=3.1.0 weasyprint>=60.0 reportlab>=4.0.0 qrcode>=7.4
openpyxl>=3.1.0 weasyprint>=60.0 reportlab>=4.0.0 qrcode>=7.4
66/66 vendors flagged this skill as clean.