Security audit
标书合规性审查工具
Security checks across malware telemetry and agentic risk
Overview
This skill is a disclosed cloud integration for tender and bid document analysis, with sensitive file upload and API-key use that match its stated purpose.
Before installing, users should be comfortable uploading commercially sensitive tender and bid files to the 百炼®标书 cloud service, storing an API key locally, and using an account where generated bid documents may consume available word balance. Keep the API key out of chat and review the service's retention and billing terms.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.