ClawHub
Back to skill

Security audit

物理教案设计

Security checks across malware telemetry and agentic risk

Overview

This is a markdown-only physics lesson-planning skill with disclosed student-profile and lab-template features, but users should apply privacy and classroom-safety controls.

Before installing, confirm teachers will use aliases, desensitize student reports, and only sync profile data with appropriate school/admin authorization. Lab examples should be reviewed by a qualified teacher and expanded with concrete safety controls before classroom use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly describes writing student profile data to downstream systems, but it does not clearly require user notice, consent, or a transparent explanation of where the data will go and what will be stored. Even though later sections mention pseudonymization and desensitization, silent propagation of student-related records can create privacy and compliance risks, especially in educational contexts involving minors.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The document includes classroom experiments involving a laser pointer, electrical circuits, and a vacuum/glass apparatus, but the surrounding safety section gives only generic guidance and omits concrete hazard warnings. In an education skill, this increases the chance that teachers or students replicate demonstrations without eye protection rules, electrical precautions, or glass/vacuum handling controls, leading to avoidable injury.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.