Tender Bid Generator

• Outcome: Pass
• Latest audit: May 29, 2026, 8:21 PM
• Version:
  1.0.0

Overview

This skill locally parses user-selected tender documents to help draft bid materials, with no evidence of hidden network access, credential use, persistence, or destructive behavior.

Install only if you are comfortable letting the agent read the specific tender files you provide. Confirm the exact file path before parsing, keep generated bid drafts in a controlled location, install dependencies from trusted sources, and have a qualified person review all pricing, compliance, and qualification content before submission.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill instructs the agent to run a local parsing script on a user-supplied file path, which is a real file-read capability, but the skill declares no permissions. That mismatch weakens security review and user consent because the agent may access local files without an explicit capability declaration or path restrictions.

VirusTotal

66/66 vendors flagged this skill as clean.