Gaokao Calculus Bridge

PassAudited by ClawScan on May 10, 2026.

Overview

This appears to be a coherent educational math skill, with cautions mainly around running local Python scripts, installing packages, and providing an OpenAI API key whose use is not clearly shown in the provided code.

This skill looks reasonable for educational math support. Before installing, use a virtual environment for the Python dependencies, provide an OpenAI API key only if needed, and avoid giving the scripts sensitive files or unrelated personal data.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI05: Unexpected Code Execution

What this means

Using the skill may run local Python scripts from the package.

Why it was flagged

The skill directs execution of bundled Python scripts as part of normal workflows. The visible code is aligned with educational generation and parsing, but it is still local code execution.

Skill content

python3 scripts/problem_generator.py \
     --domain "${DOMAIN}" \
     --difficulty "${DIFFICULTY}"

Recommendation

Run it from the reviewed skill directory, keep commands user-directed, and avoid passing sensitive files or inputs unless needed for the math task.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing dependencies may fetch newer package versions from the package repository.

Why it was flagged

The skill depends on third-party Python packages with lower-bound version constraints rather than exact pins or a lockfile. These are common math/science packages and fit the purpose, but installation still relies on the package supply chain.

Skill content

numpy>=1.21.0
matplotlib>=3.5.0
sympy>=1.10.0
pandas>=1.3.0
scipy>=1.7.0

Recommendation

Install in a virtual environment and pin or review dependency versions if you need a highly controlled setup.

Note

ASI03: Identity and Privilege Abuse

What this means

Providing this key could allow API usage and potential costs if the runtime or future code uses it.

Why it was flagged

The skill requires an OpenAI API credential. The provided code does not show hardcoding, logging, or unrelated transmission of the key, but the visible scripts also do not clearly show why the key is required.

Skill content

environment:
  required:
    - OPENAI_API_KEY

Recommendation

Use a restricted or low-quota key if possible, monitor usage, and only provide the key if the skill’s OpenAI-dependent functionality is actually needed.