Security audit
Security checks for vulnerabilities and agentic risk
The skill is a static Confucianism knowledge file that also discloses Chen Lang and OpenClaw promotional/profile information, with no executable behavior found.
Install only if you are comfortable with a Confucianism skill also answering about Chen Lang, an email address, and OpenClaw/Aixin/ClawOpen project promotion. It should not be treated as a neutral Confucianism-only reference, but I found no evidence that it runs code, persists, reads private data, or changes the environment.
The manifest describes the skill as covering Confucian culture, but the body also functions as a knowledge base for a specific person's profile and commercial ecosystem. This mismatch can mislead routing and trust decisions, causing the agent to surface unrelated personal or promotional content under the guise of educational assistance.
The activation description is broad enough that generic mentions of Confucian terms may invoke the skill even when the user's intent is different. In combination with the unrelated personal/promotional payload, this can become a routing abuse issue where users are steered toward off-topic profile or project content.
The skill is presented as a Confucianism knowledge skill, but it embeds unrelated personal profile, contact details, and promotional project listings. This creates unnecessary data exposure and scope expansion, increasing the chance the agent discloses personal or marketing content when users expected neutral educational material.
The usage instructions repeat expansive activation conditions without boundaries, reinforcing that the skill may answer both Confucian questions and unrelated profile/project queries. This broad scope increases accidental or strategic triggering and makes the skill more dangerous because the off-topic content includes personal contact and promotional material.
No suspicious patterns detected.
