qsnctf-practice-dynamic

PassAudited by ClawScan on May 1, 2026.

Overview

The skill appears benign: it retrieves public QSNCTF leaderboard and activity data, with only a minor dependency-install notice.

This skill looks appropriate for checking QSNCTF public leaderboard and solve activity. Before using it, be aware that it contacts www.qsnctf.com and may require installing the Python requests package.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

A user may need to install the requests package before using the skill.

Why it was flagged

The skill asks the user to install a Python package manually. This is disclosed and expected for the script, but the package version is not pinned or managed by an install spec.

Skill content

依赖

- Python 3.x
- requests 库

安装依赖：
```bash
pip install requests
```

Recommendation

Install dependencies only from a trusted Python environment or package index, and consider pinning versions if reproducibility matters.