Security audit
百炼标书智能写作工具
Security checks across malware telemetry and agentic risk
Overview
This skill is a disclosed cloud integration for bid-document analysis and generation, with sensitive file upload risk that matches its stated purpose.
Install only if you are comfortable uploading tender and bid documents, which may include commercial, pricing, and personal information, to the 百炼®标书 service and having results retained under your API-key account. Keep the API key out of chat, use the local config file as instructed, and confirm you have authority before uploading files for review or similarity checking.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.