企业-中标数据与营收分析

• Outcome: Pass
• Latest audit: Jun 9, 2026 at 3:33 AM UTC
• Version:
  1.0.0

Overview

This skill only guides public bid-award research and report writing, with no executable code, credentials, persistence, or mutation authority.

Install only if you want agents to perform public procurement and bid-award research about companies. Treat cash-flow, customer-dependence, and regional-expansion conclusions as analyst inferences that should be checked against cited public sources.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The activation description is broad enough to trigger on general competitive-intelligence, due-diligence, or customer-analysis queries without tight boundaries. That can cause the skill to run unexpectedly, perform unnecessary web searches, and produce inferred financial or customer-profile claims about a company, increasing privacy, accuracy, and misuse risks.

VirusTotal

64/64 vendors flagged this skill as clean.