bidcheckup-batch-compliance-free
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security risks were detected. The skill's code is transparent and focused on its stated purpose of bid document arithmetic validation.
- [DATA_EXFILTRATION]: The engine implementation explicitly avoids network modules (such as
http,https, orfetch) and performs all analysis locally, ensuring bid data does not leave the user's environment. - [REMOTE_CODE_EXECUTION]: No remote code execution or dynamic code evaluation patterns (like
eval()orexec()) were found. The installation instructions for the optional paid version point to a legitimate package (@alipay/agent-payment) associated with a well-known payment provider. - [INDIRECT_PROMPT_INJECTION]: While the skill ingests untrusted bid data for processing, it does so using a dedicated JavaScript engine that performs mathematical validation rather than interpreting the text as instructions for the agent, effectively mitigating injection risks.
Audit Metadata