Security audit
百炼标书智能写作工具
Security checks across malware telemetry and agentic risk
Overview
This skill is a disclosed client for uploading user-selected bid documents to the 招采猫 API to generate and review tender files.
Before installing, users should understand that tender and bid files may contain confidential business, pricing, and personal data and will be uploaded to 招采猫 servers under the configured App Key account. Configure the App Key locally rather than pasting it into chat, review the billing/points impact before generation, and only use this with documents you are allowed to send to that service.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
50/50 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.