Security audit
标书制作工具
Security checks across malware telemetry and agentic risk
Overview
This skill is a disclosed client for uploading user-selected bid documents to a specific cloud API, generating bid-related outputs, and storing an App Key locally.
Install only if you are comfortable sending tender and bid files, which may contain commercial or personal data, to 招采猫 cloud processing under your App Key. Treat the App Key like a password, prefer manual configuration if you do not want it in chat history, avoid custom ZCM_BASE endpoints unless trusted, and expect bid generation to consume account credits.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.