Security audit
Security checks for vulnerabilities and agentic risk
ClawScan classifies this skill as benign because the reported capabilities and behavior appear aligned with managing online voting activities, while noting broad activation wording and undeclared tool scope.
The scanners completed coverage of all seven listed components. Before installing, consider whether broad activation on voting-related language suits you, and review the requested permissions and external image-upload destination; the verdict is benign, but not risk-free.
Without declared permissions the skill's intent is opaque and cannot be validated.
Line 30 activates the skill whenever the user mentions voting (投票) or selection (评选). This can include general discussions of elections, selection criteria, or participation in an existing poll, rather than requests to create or manage a 才谷网 voting activity; no exclusions distinguish those cases.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
resp = requests.post(url, files={"file": f}, data={"crop": crop or ""},
headers=_headers(token), timeout=120)
else:
resp = requests.post(url, json={"image_url": image_url or "", "crop": crop or ""},
headers=_headers(token), timeout=120)
except requests.RequestException as e:
return {"success": False, "code": -1, "msg": "网络请求失败：%s" % e.__class__.__name__, "data": None}
The applicability list includes any user mention of “投票” (voting) or “评选” (selection/awards), without requiring an intent to create or manage a voting activity. This could activate the skill during general discussions of voting or selection processes; no exclusion conditions are provided.