个人AI能力测评工具

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:20 PM UTC
• Version:
  1.0.0

Overview

This skill is a local AI self-assessment/report generator with proportionate file output and no evidence of credential access, network exfiltration, or destructive behavior.

Install only if you are comfortable running a local Python assessment script and saving assessment reports under your OpenClaw workspace. Avoid entering employer secrets, client data, or sensitive personal details, and review any generated report before sharing it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill advertises report export and local file generation but does not declare the file-write capability explicitly. Undeclared write behavior is dangerous because it can surprise users and bypass expected consent or permission review, especially when assessment results may contain personal profile data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is assessment, but the behavior includes writing reports to a local directory and embedding fixed external contact details, which are unrelated to the core function. This mismatch undermines informed consent and creates privacy and trust risks, as users may unknowingly have sensitive assessment results persisted locally and exposed to unsolicited external contact channels.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill creates a persistent reports directory in the user's workspace and later writes Markdown/HTML assessment reports there, which exceeds a simple question-answering assessment role. Persistent file creation can surprise users, accumulate sensitive self-assessment data on disk, and broaden the skill's data-handling footprint beyond what is necessary.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger examples are broad natural-language phrases such as asking to assess or improve AI ability, which can overlap with ordinary conversation and cause the skill to activate unexpectedly. In an agent setting, overbroad routing can lead to unintended collection of user information, incorrect tool execution, or disruption of normal dialogue flow even without any overtly malicious content.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill collects user background information and produces shareable/exportable reports without clearly disclosing privacy, retention, sharing, or data-handling practices. In this context, the collected data may include personal profile, skill gaps, and potentially workplace-related details, so lack of transparency materially increases privacy and misuse risk.

VirusTotal

64/64 vendors flagged this skill as clean.