Автоматический поиск клиентов (родителей) для репетитора по математике в группах ВКонтакте с умной фильтрацией и приоритизацией онлайн-запросов.

PassAudited by ClawScan on May 1, 2026.

Overview

The skill is a coherent VK lead-monitoring helper, but users should notice that it uses a VK service token, runs recurring scans, and stores social-media lead data locally.

Before installing, decide which VK groups should be monitored, use a dedicated VK service token, keep the generated CSV private, and make sure you know how to stop the 3-hour recurring monitoring schedule.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If the token is mishandled, someone else could use it to access VK API functionality available to that token.

Why it was flagged

The skill requires a VK service token to call VK APIs. This is expected for the VK monitoring purpose, but it is still a credential that should be scoped and protected.

Skill content
**VK_API_TOKEN**: Сервисный ключ доступа приложения (Service Token) для чтения открытых стен.
Recommendation

Use a dedicated VK app/service token, do not paste it into shared chats or public files, and rotate it if it may have been exposed.

NoteHigh Confidence
ASI10: Rogue Agents
What this means

The agent may keep scanning VK groups and updating the output file on a schedule until the user stops it.

Why it was flagged

The skill asks the agent to create recurring monitoring. This persistence is disclosed and central to the monitoring purpose, but users should be aware it may continue running after the initial request.

Skill content
**Настрой расписание**: Установи таймер повторения задачи на каждые **3 часа**.
Recommendation

Confirm the target groups and interval before enabling monitoring, and keep a clear way to pause or remove the scheduled task.

What this means

The saved CSV may contain personal information from VK posts and should not be treated as harmless disposable data.

Why it was flagged

The skill stores retrieved VK content, including author names and request snippets, in a persistent CSV lead file. This is purpose-aligned, but it retains social-media data and untrusted text for later use.

Skill content
`Дата_Время | Название_Группы | Ссылка_на_пост | Имя_Автора | Текст_Запроса ... | Приоритет | Статус`
Recommendation

Store the CSV in a private location, limit retention to what you need, and review entries before sharing or importing them into other systems.