v1.0.0

Автоматический поиск клиентов (родителей) для репетитора по математике в группах ВКонтакте с умной фильтрацией и приоритизацией онлайн-запросов.

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 5:43 AM.

Analysis

The skill is a coherent VK lead-monitoring helper, but users should notice that it uses a VK service token, runs recurring scans, and stores social-media lead data locally.

GuidanceBefore installing, decide which VK groups should be monitored, use a dedicated VK service token, keep the generated CSV private, and make sure you know how to stop the 3-hour recurring monitoring schedule.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Rogue Agents

SeverityLowConfidenceHighStatusNote

SKILL.md

**Настрой расписание**: Установи таймер повторения задачи на каждые **3 часа**.

The skill asks the agent to create recurring monitoring. This persistence is disclosed and central to the monitoring purpose, but users should be aware it may continue running after the initial request.

User impactThe agent may keep scanning VK groups and updating the output file on a schedule until the user stops it.

RecommendationConfirm the target groups and interval before enabling monitoring, and keep a clear way to pause or remove the scheduled task.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

SKILL.md

**VK_API_TOKEN**: Сервисный ключ доступа приложения (Service Token) для чтения открытых стен.

The skill requires a VK service token to call VK APIs. This is expected for the VK monitoring purpose, but it is still a credential that should be scoped and protected.

User impactIf the token is mishandled, someone else could use it to access VK API functionality available to that token.

RecommendationUse a dedicated VK app/service token, do not paste it into shared chats or public files, and rotate it if it may have been exposed.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Memory and Context Poisoning

SeverityLowConfidenceHighStatusNote

SKILL.md

`Дата_Время | Название_Группы | Ссылка_на_пост | Имя_Автора | Текст_Запроса ... | Приоритет | Статус`

The skill stores retrieved VK content, including author names and request snippets, in a persistent CSV lead file. This is purpose-aligned, but it retains social-media data and untrusted text for later use.

User impactThe saved CSV may contain personal information from VK posts and should not be treated as harmless disposable data.

RecommendationStore the CSV in a private location, limit retention to what you need, and review entries before sharing or importing them into other systems.