Skills/ClawHub/biaoshu-writer-corp

biaoshu-writer-corp@2.0.6

VERIFIED

Publisher claims: "上传招标/投标文件，AI 一站式完成智能解读（废标红线/评分标准/控标洞察）、成品投标文件(.docx)生成、标书审查（分级风险+雷同检测）和标书查重（2-3份投标文件相似/雷同风险检查）。覆盖投标、招标、标书、投标文件、竞标、围标、控标、废标、评分标准、资格条件、技术标、商务标、暗标、响应文件、应答文件、雷同检测、相似检查、标书查重等场景——当用户提供或提及招标/投标文件、问「这个标能不能投 / 有哪些废标红线 / 帮我写投标书 / 检查标书有没有问题 / 两份投标文件像不像 / 会不会被判雷同」，或想解读招标文件、生成投标文件、做标书审查或查重时使用。需百炼®标书 Api Key（新用户零输入免费试用，赠 50,000 字；手机号注册赠 5 万字）；文件经百炼®标书云端处理，智能解读免费，标书制作/审查/查重按可用字数计费。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher liu-jiapeng · joined 0 days agoInstalls 657Last detonated 5 h ago
$clawhub install biaoshu-writer-corp
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-28 and scored it 91/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
File type combined with upload actionscripts/zcm_lib/cli.py:12 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

No other findings across 4,605 lines in 27 files.