Virtual User Skill
Analysis
The skill’s virtual-user purpose is plausible, but it under-declares local command execution, encryption-key/data access, unpinned dependency/model installs, and persistent data-processing behaviors.
Findings (9)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
cd /Users/xuwenxiang/.copaw/active_skills/virtual_user_skill && /Users/xuwenxiang/.copaw/active_skills/virtual_user_skill/venv/bin/python3 search_scenarios.py "用户的问题" 20
The skill instructs the agent to run a local shell command with the user’s question as an argument, even though the supplied requirements declare no binaries, config paths, or capability tags; the artifact does not clearly bound approval or execution scope.
sentence-transformers>=2.2.0 numpy>=1.21.0 scikit-learn>=1.0.0 cryptography>=3.4.0 pandas>=1.3.0
Dependencies are specified with lower bounds rather than pinned versions or hashes, while other artifacts install them and load a transformer model; this leaves package/model provenance and reproducibility weak.
python3 -m venv venv source venv/bin/activate pip install -q -r requirements.txt python3 src/encrypt.py
The startup script creates a virtual environment, installs dependencies, and runs local initialization code. This is purpose-aligned setup behavior, but users should notice it because the registry describes the skill as having no install spec.
files = [f for f in DOWNLOADS_DIR.iterdir() if f.suffix == '.xlsx' ...] with open(OUTPUT_DIR / "scenario_library.json.enc", 'w') as f: np.save(OUTPUT_DIR / "scenario_embeddings.npy", embeddings)
The merge script processes all Excel files in Downloads and then overwrites the persistent encrypted library and vector embeddings, so one unintended file can propagate into future retrieval results.
加密数据文件可安全提交到 GitHub 运行时自动解密，不暴露原始数据
The privacy wording is broad, while other artifacts generate plaintext sample data and require a local decryption key; users may over-trust the strength and completeness of the protection.
sudo systemctl enable virtual_user sudo systemctl start virtual_user
The deployment guide includes optional persistent service setup. It is disclosed and purpose-aligned for production use, but it can keep the skill running beyond a single user task.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
密钥位置：~/.virtual_user/.key
The skill relies on a local encryption key to access the scenario library, but the supplied requirements declare no primary credential and no required config paths, under-disclosing the permission boundary.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
sample_file = output_dir / "sample_scenarios.json" json.dump(scenarios[:5], f, ensure_ascii=False, indent=2)
The data-preparation script writes raw sample scenario records to a plaintext JSON file, creating persistent context outside the encrypted scenario library and weakening the stated privacy posture.
app.run(host='0.0.0.0', port=5000)
The optional API deployment example binds a Flask service to all interfaces; the document later advises adding authentication, but the sample itself does not implement identity or origin checks.