cue-bid-panorama-cn@0.1.3
VERIFIED· install onlyPublisher claims: "招投标披露全景卡：输入一单工程的招标公告或中标公示，产出八项逐字卡——项目名称与编号、招标人与代理机构、开标时间与方式、评标标准与方法、中标候选人及金额、中标公示与日期、合同履约与期限、异议与质疑渠道。每项挂原句＋锚，缺的点名「未检索到」；中标金额必须带数字原值，「详见公告」不算。中标概率、是否利好、收入影响一律 [待人工]，不出投标建议、不接代客投标。Do NOT use for: 投标决策与中标预测、代客投标、未检索到的条款编造或补全、收益与风险承诺。Triggers: 中标结果 / 开标时间 / 评标办法；bid disclosure card" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-14 and scored it 93/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
No findings across 1,172 lines in 11 files.
Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.