Gaokao Calculus Bridge

AdvisoryAudited by VirusTotal on Apr 12, 2026.

Overview

Type: OpenClaw Skill Name: gaokao-calculus-bridge Version: 1.0.2 The skill bundle is a legitimate educational tool designed to bridge high school and college mathematics. All included Python scripts (such as scripts/model_extractor.py and scripts/problem_generator.py) perform transparent text processing, regex-based information extraction, and logic-based content generation without any dangerous system calls, network activity, or obfuscation. The SKILL.md instructions and supporting documentation in the references/ and templates/ directories are strictly aligned with the stated purpose of math tutoring and do not contain any malicious prompt injection attempts or unauthorized data access requests.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI05: Unexpected Code Execution

What this means

Using the skill may run local Python scripts from the package.

Why it was flagged

The skill directs execution of bundled Python scripts as part of normal workflows. The visible code is aligned with educational generation and parsing, but it is still local code execution.

Skill content

python3 scripts/problem_generator.py \
     --domain "${DOMAIN}" \
     --difficulty "${DIFFICULTY}"

Recommendation

Run it from the reviewed skill directory, keep commands user-directed, and avoid passing sensitive files or inputs unless needed for the math task.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing dependencies may fetch newer package versions from the package repository.

Why it was flagged

The skill depends on third-party Python packages with lower-bound version constraints rather than exact pins or a lockfile. These are common math/science packages and fit the purpose, but installation still relies on the package supply chain.

Skill content

numpy>=1.21.0
matplotlib>=3.5.0
sympy>=1.10.0
pandas>=1.3.0
scipy>=1.7.0

Recommendation

Install in a virtual environment and pin or review dependency versions if you need a highly controlled setup.

Note

ASI03: Identity and Privilege Abuse

What this means

Providing this key could allow API usage and potential costs if the runtime or future code uses it.

Why it was flagged

The skill requires an OpenAI API credential. The provided code does not show hardcoding, logging, or unrelated transmission of the key, but the visible scripts also do not clearly show why the key is required.

Skill content

environment:
  required:
    - OPENAI_API_KEY

Recommendation

Use a restricted or low-quota key if possible, monitor usage, and only provide the key if the skill’s OpenAI-dependent functionality is actually needed.