ClawHub
Back to skill

Security audit

政府采购盲投参谋gov-blind-bid-advisor

Security checks across malware telemetry and agentic risk

Overview

This skill is a purpose-aligned procurement bidding advisor that uses public procurement data, local business-profile files, and disclosed compliance guardrails.

Before installing, be aware that the skill can run local Python scripts, save business-profile and report files locally, make GET requests to the China government procurement site, and optionally query an IMA knowledge base if your host provides that MCP tool. Review generated bid advice manually, especially pricing, competitor, locality, and legal-risk conclusions; the artifact itself frames those outputs as decision support, not legal or financial advice.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill describes concrete capabilities to read and write local files (`enterprise.json`) and perform network collection against `ccgp.gov.cn`, but the manifest does not declare corresponding permissions. Undeclared capabilities weaken host-side trust and policy enforcement because a reviewer or runtime may underestimate what the skill can access, even if the intended use is legitimate.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The project text explicitly states '本地注册企业优先', which introduces a regional preference without any documented legal or procurement justification. In a government procurement bidding advisor, this is dangerous because it can normalize or propagate potentially discriminatory criteria, skew bid/no-bid decisions, and reduce fair competition based on geography rather than lawful qualification requirements.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.