Security audit

Bid Collection

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed public tender-monitoring skill with optional scheduled checks, and the reviewed artifacts do not show hidden code, credential access, or deceptive behavior.

Before installing, be comfortable with the skill making outbound web requests to procurement platforms and writing reports locally. Only enable monitor after reviewing the scheduled-task side effects, use monitor --stop when finished, and add only trusted public source URLs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

Confidence: 80% confidence
Finding: The manifest description prominently presents the skill in Chinese and English, but the title and branding center a specific locale/language context without documenting user choice or a justified region-specific constraint. For organizational language/locale policy, this can be interpreted as a locale-specific skill presentation without explicit opt-in or explanation.

Natural-Language Policy Violations

Low

Confidence: 82% confidence
Finding: This markdown file presents only China-based platforms and Chinese regional procurement sources, which can amount to an implicit locale constraint if used as a general monitoring skill reference. The file does not state that this scope is China-specific or that users may choose other locales, so it may conflict with language/locale neutrality expectations.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.