Skills/ClawHub/bidhunter

bidhunter@2.9.1

CAUTION

Publisher claims: "国央企招投标信息监控与研判技能。自动采集多平台公告，按资质规则比对可投性（可投/不可投/需确认），生成带研判简报并多通道推送。v1.5 起新增：资质匹配度评分(0-100)、投标日历与开标倒计时、金额/地区/行业多维筛选、零代码规则编辑器、诊断中心、示例模式、集中FAQ、统一命令入口；v2.0 本地AI增强（招标文件AI速读+风险条款识别，零云成本）；v2.5 投标策略建议；v3.0 本地开放API+签名webhook；v3.5 合规红线引擎（31条法定废标红线本地扫描、交标前自查清单、多主体串标隔离，零API成本）；v2.7 报价闸门（品类清算价地板、规模换算线性、单位单价、毛利红线，任一道不过即禁止输出结论金额）。★v2.8 覆盖率重写：修复只读前9000字符导致200页标书95%未读的缺陷，改为结构化分片全覆盖并强制标注覆盖率；修复PDF/DOCX扫描静默失效（此前规则命中恒为0）；新增评分点逐项映射与分值守恒校验、待补材料清单（高危红标签字盖章页缺件）、零响应检测（空洞满足/待补占位/跨项目残留/数字型空洞），无AI key也能出完整简报。触发词：抓招投标、今日哪些能投、标讯监控、标书研判、招投标公告、央企招标、投标资质匹配、AI读标书、投标建议、这份标会不会被废、废标风险、交标前检查、合规红线扫描、多主体投标、会不会被认定串标、报价闸门、这个标报多少、报价复核、出价前检查、这个标值不值得投、报价会不会被废、待补材料清单、还差什么材料、零响应检测、评分点、评分表、评分办法、这个分怎么拿、漏项、丢分、扣分项、待补、待提供、准备什么材料、递交清单、应答表、偏离表、评分台账、评分项跟踪、覆盖矩阵、哪些评分项没写、哪条要求没响应。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher 419597334-sudo · joined 10 days agoInstalls 1,236Last detonated 5d ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-29 and scored it 73/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Outbound HTTP to raw IP address; Outbound HTTP to raw IP address. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
Python subprocess execution detectedscripts/feedback.py:186 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Outbound HTTP to raw IP addressscripts/api_server.py:52 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedscripts/doctor.py:91 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/ai/doc_parser.py:36 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Outbound HTTP to raw IP addressscripts/api_server.py:103 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedscripts/feedback.py:193 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/feedback.py:176 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/demo.py:33 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL using raw IP addressscripts/api_server.py:103 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addressscripts/api_server.py:52 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Process kill commandscripts/material_gap.py:10 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/demo.py:43 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/rule_editor.py:87 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/feedback.py:181 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/feedback.py:201 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/bidhunter.py:61 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/rule_editor.py:100 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/bidhunter.py:51 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/doctor.py:123 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/demo.py:48 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

What would make this Verified

7 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim 419597334-sudo: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Outbound HTTP to raw IP address≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  3. New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
  4. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  5. URL using raw IP address≈ +2 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  6. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim 419597334-sudo