Axiomata Skill Evaluator Zh

PassAudited by ClawScan on May 13, 2026.

Overview

This appears to be a local skill-quality checker with no evidence of malicious behavior, but users should scope its local scans and note minor metadata inconsistencies.

This skill looks safe for normal local skill evaluation. Before installing or invoking it, confirm the target path, avoid --all unless you want a broader local scan, and do not provide credentials because the artifacts do not document any need for them.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI05: Unexpected Code Execution

What this means

Running the skill executes local Python code that reads the selected skill directory to produce an evaluation report.

Why it was flagged

The skill asks the user or agent to execute bundled Python scripts locally. This is expected for a self-contained evaluator, but it is still local code execution.

Skill content

python3 ${EVAL_PATH}evaluator.py <SKILL_PATH> --verbose
python3 ${EVAL_PATH}eval-skill.py <SKILL_PATH> --verbose

Recommendation

Run it only from the installed skill directory you intended to use, and review the target path before execution.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If used accidentally, the evaluator may inspect more local skill folders than the user meant to evaluate.

Why it was flagged

The documented --all mode broadens the operation from one skill to all skills in a parent directory. This is useful and disclosed, but it expands local read scope.

Skill content

# 评估父目录中的所有技能
python3 <技能目录>/scripts/evaluator.py --all

Recommendation

Use a specific skill path by default, and use --all only after confirming the directory scope.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users rely on the registry-provided bundled scripts rather than an independently verifiable upstream project.

Why it was flagged

The skill includes executable scripts but does not provide an upstream source or homepage for provenance checking. No remote installer or dependency risk is shown.

Skill content

Source: unknown
Homepage: none
Install specifications: No install spec — this is an instruction-only skill.

Recommendation

Review the bundled scripts before first use if provenance matters for your environment.