Tender Analysis System

• Outcome: Review
• Latest audit: May 29, 2026 at 9:31 PM UTC
• Version:
  1.0.0

Overview

The skill matches its tender-monitoring purpose, but its setup script can install recurring background cron jobs without enough scoping or removal controls.

Install only if you intentionally want this skill to run periodically in the background. Before running cron_setup.sh, inspect the exact crontab lines, decide whether hourly execution is acceptable, create the logs/data directories as needed, and know how to remove only these cron entries later. Treat any configured email, Feishu webhook, or LLM API key as sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script persistently modifies the user's crontab without any confirmation, dry-run, or clear disclosure of the exact entries being installed. In an agent skill context, silent persistence is security-relevant because it creates recurring execution that survives the current session and could repeatedly run code or exfiltrate data if the companion script changes later.

VirusTotal

64/64 vendors flagged this skill as clean.