Security audit

投标暗标格式合规扫描Bid Blind Bid Format Scanner

Security checks across malware telemetry and agentic risk

Overview

This skill locally checks uploaded bid documents for blind-review formatting and identity leaks, with no evidence of hidden network use, persistence, or unrelated access.

Install only if you want local blind-bid compliance checks on tender documents. The skill will read uploaded DOCX/PDF content and metadata and may output short matching context snippets, so treat reports as sensitive and avoid sharing confidential bid material through the listed external feedback channel.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger list includes very broad, natural user phrases, increasing the chance the skill is invoked outside its intended scope. In an agent system, over-broad activation can cause unintended document handling, unnecessary access to uploaded files, and execution of the skill’s downstream workflow when the user only wanted general advice.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The condition 'user uploads a file and asks to check formatting' is too underspecified, so the skill may activate on unrelated documents or generic formatting requests. Because this skill processes uploaded files and may run scripts, unclear activation boundaries increase the risk of inappropriate file analysis and unintended data exposure within the agent workflow.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.