ClawHub
Back to skill

Security audit

墨灵高考作文批改

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward essay-correction skill that sends user-provided essay text to InkCraft as its disclosed core function.

Install only if you trust InkCraft with the essay prompt, essay body, and any optional reference text you provide. Use a revocable InkCraft API key, keep INKCRAFT_BASE_URL on the official service unless you intentionally trust another endpoint, and avoid submitting sensitive personal information unless you are comfortable sharing it with that service.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill sends user-provided essay content to an external InkCraft API, but the description does not clearly disclose that user text will leave the platform. This creates a data-transparency and privacy risk because users may submit sensitive personal or educational content without informed consent.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
BASE_URL="${INKCRAFT_BASE_URL:-https://www.inkcraft.cn}"
curl -sS -X POST "$BASE_URL/api/skills/essay-correction" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $INKCRAFT_API_KEY" \
  -H "x-api-key: $INKCRAFT_API_KEY" \
Confidence
97% confidence
Finding
curl -sS -X POST "$BASE_URL/api/skills/essay-correction" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $INKCRAFT_API_KEY" \ -H "x-api-key: $INKCRAFT_API_KEY" \ -d

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal