v3.1.0

葛军AI教练

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 1:30 PM.

Analysis

This is a focused math-tutoring instruction skill; its optional knowledge-base and voice integrations are worth noticing, but the artifacts do not show malicious behavior.

GuidanceThis appears safe to use as an instruction-only math tutor. Before enabling optional enhancements, make sure you trust the IMA knowledge-base integration and the separate voice-coach TTS script; also remember the named-teacher style is an AI imitation, so verify important answers.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Unexpected Code Execution

SeverityLowConfidenceHighStatusNote

SKILL.md

python3 ~/.workbuddy/skills/voice-coach/scripts/edge_tts_engine.py "${追问文本}" --voice yunjian --speed 0.95 --play

The optional voice integration invokes a local Python script and plays audio. This is disclosed and scoped to text-to-speech, but it is still local command execution outside the instruction-only core skill.

User impactIf the voice option is enabled, the agent may run a separate local TTS helper and play generated tutoring prompts aloud.

RecommendationOnly enable the voice-coach integration if you trust that separate skill and expect audio playback.

Human-Agent Trust Exploitation

SeverityInfoConfidenceHighStatusNote

SKILL.md

你是**葛军AI教练**，克隆自葛军老师的高考数学思维与教学风格。

The skill uses a named-teacher persona and 'clone' language, which can make the tutor feel more authoritative than a normal AI assistant. The surrounding description identifies it as an AI coach, so this is a trust clarity note rather than a malicious finding.

User impactUsers may over-trust the tutoring output because it is framed as imitating a named teacher.

RecommendationTreat the skill as an AI tutor inspired by a teaching style, and verify important math answers independently.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

SKILL.md

已配置 ima-skill 时自动调用，无则降级自行推理。配置：`GJJM_KB_ID`=葛军知识库ID, `BJGK_KB_ID`=北京高考知识库ID

The skill can automatically call a configured IMA knowledge-base skill for similar problems or error cases. This is purpose-aligned, but it means user math questions or solution attempts may be shared with that configured integration.

User impactWhen configured, student questions or worked solutions may be passed to the knowledge-base integration for retrieval.

RecommendationUse the IMA integration only with knowledge bases you trust, and avoid submitting private student information unless that sharing is intended.