导数取点

PassAudited by ClawScan on May 9, 2026.

Overview

This is an instruction-only math proof skill with no runtime code, credentials, or data access; the only notable item is user-directed GitHub clone installation guidance.

This appears safe to use as an instruction-only math-solving skill. Before manually cloning the GitHub repository mentioned in the README, verify that the repository contents match the reviewed files and do not add unexpected code or instructions.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If a user chooses to install from the GitHub URL, they are trusting that external repository's contents as agent skill instructions.

Why it was flagged

The README documents user-run installation from an external GitHub repository into an agent skill directory. This is normal for manual skill installation and there is no automatic execution or code in the reviewed bundle, but users should still verify the repository before cloning.

Skill content

git clone https://github.com/Jiuxiao-yunwai/derivative-point-picking.git ~/.codex/skills/derivative-point-picking

Recommendation

Install from the trusted registry when possible, or inspect the GitHub repository contents before cloning it into a local skill directory.