Tencent Yuanbao Gaokao - Regional Passing Scores

PassAudited by ClawScan on May 14, 2026.

Overview

This appears to be a benign Gaokao score lookup skill, with normal notes about running an included helper script and sending query filters to Tencent’s Gaokao endpoint.

This skill is reasonable for querying Gaokao regional score lines. Before installing, be aware that it may run its included Python helper and contact Tencent’s Gaokao data endpoint with the province/year/track filters you provide.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Your agent may execute a local Python script to retrieve the requested score-line data.

Why it was flagged

The skill instructs the agent to run an included Python helper, potentially even when filters are broad or absent. This is expected for the lookup purpose and is bounded to the provided helper script.

Skill content

若未提取到任何信息，也需要调用脚本获取数据。 ... python3 ./fetch_data.py --place {place...} --year {year...} --student {student...} --luqupici {luqupici...}

Recommendation

Use the skill for relevant Gaokao score queries and provide clear province/year/track filters when possible.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

The external service can see the province, year, and exam-track filters used in the lookup.

Why it was flagged

The helper sends selected query fields to an external Tencent Gaokao endpoint. No credentials or local files are evidenced as being transmitted.

Skill content

BASE_URL = "https://gaokao.search.qq.com/skills_data" ... url += f"&place={urllib.parse.quote(place)}" ... url += f"&year={urllib.parse.quote(year)}" ... url += f"&student={urllib.parse.quote(student)}"

Recommendation

Avoid including unnecessary personal details in queries; use only the criteria needed for score-line lookup.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

You have less publisher/source context than for a skill with a public repository or homepage.

Why it was flagged

The registry information does not provide an external source repository or homepage, limiting independent provenance checks. The supplied artifacts show no install-time dependency fetch or hidden installer.

Skill content

Source: unknown; Homepage: none

Recommendation

Install only if you trust the registry entry or have reviewed the included artifacts sufficiently for your use.