ClawHub

高等数学学情数据分析Skill

Security checks across malware telemetry and agentic risk

Overview

This education analytics skill is coherent, but it handles identifiable student profiles, rankings, and risk predictions without enough privacy or access-control guidance.

Install only if you will use it under an approved educational data policy. Avoid unnecessary identifiers, restrict individual reports to authorized educators, do not share rankings or risk flags broadly, and define retention, deletion, export, and audit practices before using real student data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill is explicitly designed to collect, analyze, predict, and surface sensitive student performance data, including risk warnings and learning profiles, but it provides no privacy, consent, minimization, retention, or access-control guidance. In an educational context this is dangerous because operators may expose academic records or make consequential decisions about students without appropriate safeguards.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The student profile output includes directly identifiable information such as name, class, detailed performance history, weak topics, behavioral trends, and class-relative ranking/percentiles without any masking or privacy notice. This creates a clear risk of unauthorized disclosure, profiling, stigmatization, or misuse of student data, especially if outputs are exported or shared beyond need-to-know personnel.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal