Math Viz

PassAudited by ClawScan on May 10, 2026.

Overview

Math Viz appears purpose-aligned for creating interactive math HTML, with disclosed local validation and CDN library use that users should notice.

This skill looks reasonable for math visualization. Before using it, be comfortable with it creating local HTML files, running its verifier script, and opening pages that load JSXGraph or Three.js from public CDNs. Avoid putting sensitive content into generated pages if they may be shared.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may run a local script that reads the generated HTML and uses local tools such as Python or Node for checks.

Why it was flagged

The skill explicitly tells the agent to run a bundled local shell verifier after generating HTML. This is disclosed and aligned with validating the generated page, but it is still local command execution.

Skill content
bash ~/.workbuddy/skills/math-viz/scripts/verify_output.sh <生成的HTML文件>
Recommendation

Run the verifier only on generated workspace HTML files, keep output filenames simple, and review the helper script if you require strict local-execution controls.

What this means

Opening the generated page may contact public CDNs and execute their hosted visualization libraries in the browser.

Why it was flagged

The generated HTML is expected to load third-party JavaScript libraries from public CDNs, which is normal for this visualization purpose but depends on external providers.

Skill content
CDN引入库:JSXGraph用 `cdnjs.cloudflare.com`,Three.js用 `cdn.jsdelivr.net`
Recommendation

Use this on networks where CDN access is acceptable; for distribution or sensitive environments, consider pinning with integrity checks or using locally hosted library copies.