tenderaudit-full-compliance-free
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill transmits bidding information to an external API endpoint for processing.\n
- Evidence: The script
scripts/run.mjsusesfetch()to send data tohttps://www.tokendidi.cn/api/v1/tender-compliance-audit/free.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text from bidding documents, creating a potential surface for indirect prompt injection attacks.\n - Ingestion points:
scripts/run.mjsreads bidder information from JSON files provided by the user.\n - Boundary markers: None; there are no delimiters or instructions to ignore instructions embedded within the document text.\n
- Capability inventory: The skill is configured with
BashandReadtools, andscripts/run.mjsperforms network operations.\n - Sanitization: The skill does not implement sanitization or validation of the text content before it is processed or transmitted.
Audit Metadata