ClawHub
Back to skill

Security audit

高等数学作业全生命周期管理套件

Security checks for vulnerabilities and agentic risk

Overview

This education skill is coherent, but it is suitable for Review because it handles student submissions, profiles, grading data, and external AI/OCR services without enough privacy and governance detail.

Review before installing in a real classroom or with identifiable student work. Verify the four dependent skills separately, use only institution-approved AI/OCR providers and scoped API keys, and require documented consent, retention/deletion rules, access controls, and data-minimization settings before processing student data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The README shows a grading example that base64-encodes and submits a homework image, but it does not disclose that student work and potentially sensitive educational data may be transmitted to the skill backend and possibly third-party services. In an education context, this omission can cause users to unknowingly export student data, creating privacy, consent, and regulatory risk rather than direct code-execution risk.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The README advertises integrations with OCR, LLM, speech, and visualization APIs without warning that student submissions, class analytics, or other potentially sensitive data may be shared with external providers. Because this skill suite is explicitly designed for handling homework, grading, and learning analytics, the missing disclosure is more dangerous than in a generic demo since it likely involves educational records and student-generated content.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill explicitly handles student submissions, personal learning profiles, class analytics, and error analysis, but the documentation provides no privacy notice, retention policy, consent model, or access-control expectations. In an education context, this can expose sensitive student data and create compliance and misuse risks, especially because the suite aggregates identifiable academic performance information across multiple modules.

Static analysis

No suspicious patterns detected.