Skills/ClawHub/bid-quote-cockpit

bid-quote-cockpit@1.0.0

VERIFIED

Publisher claims: "通用投标报价对比分析驾驶舱。适用于新门店/新项目收到多家供应商报价（支持多轮回标/澄清后报价），需快速产出「总价排名 + 分部分项横向对比 + 单方造价 + 异常报价核查 + 勾稽校验 + 评分定标 + 行动清单」自包含交互式 HTML 看板的场景，并可直接上线发布（云端 Page / 公开链接）。支持条件模块：历史门店数据、评委打分与定标结论均由使用者**可选**提供（提供才渲染对应节）；评委打分一经提供即**固化进 HTML 字节**，任何人任何设备打开结果一致，页面只读不可改。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher chenzhe223-tech · joined 5 days agoInstalls 290Last detonated 4d ago
$clawhub install bid-quote-cockpit
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-30 and scored it 87/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
Python subprocess execution detectedbid-quote-cockpit/scripts/check_overflow.py:146 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedbid-quote-cockpit/scripts/verify_score_frozen.py:223 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedbid-quote-cockpit/scripts/dump_rendered.py:115 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05