ClawHub
Back to skill

Security audit

班级错因分析

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed math-teaching error-analysis skill that handles student performance context but does not include hidden execution, credential use, or destructive behavior.

Installers should treat this as a student-performance data workflow: use aliases or IDs, avoid entering real names unless explicitly needed and authorized, and confirm before writing reports or profiles into downstream student-analysis, lesson-planning, or resource-library systems.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The activation cues in the metadata description are very broad and match ordinary teacher requests such as asking where students made mistakes or what to teach next. In a multi-skill environment, this can cause unintended invocation, route sensitive student-performance context into the wrong workflow, and produce actions outside the user's intended scope.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger section lists overlapping scenarios like '下次课讲什么' and '学员错在哪里' without clear boundary conditions separating this skill from adjacent skills. That ambiguity increases the chance of misrouting requests, unnecessary access to class/student error data, and cross-skill data propagation into downstream systems such as student profiles or lesson plans.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.