ClawHub
Back to skill

Security audit

学分查询技能

Security checks across malware telemetry and agentic risk

Overview

This is a simple local student-score lookup skill, with privacy caveats around grade data and console logging.

Install only if the included student scores are sample data or you are authorized to expose them. The publisher should clarify the credit-vs-grade naming, remove the unused ffmpeg requirement, and avoid logging raw student grade queries in shared or retained logging environments.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
The skill is labeled as a credit-query capability, but the documentation describes functionality for retrieving detailed student grades and full transcripts. This mismatch can mislead reviewers, users, and policy enforcement systems, causing a privacy-sensitive student-record access skill to be approved or invoked under a less sensitive label.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill logs raw user queries to the console, and those queries may contain student names and requests for academic records. In environments where logs are centrally collected or accessible to admins, this creates unnecessary exposure of education-related personal data and may violate privacy expectations or policy.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal