ClawHub
Back to skill

Security audit

学情分析师

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed teacher-oriented student performance analysis skill, with sensitive-data handling that is mostly scoped and purpose-aligned.

Installers should treat this as a sensitive education-data tool: use it only with authorized class data, prefer student IDs or aliases, avoid public reports with names, and confirm before sharing or writing outputs into other skills.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger examples are broad natural-language requests such as analyzing class performance or generating learning reports, but they do not require confirmation that the user actually has appropriate authority or the necessary student data context before activation. In an education skill handling sensitive student performance information, over-broad activation can cause the agent to enter a high-sensitivity workflow too easily, increasing the chance of unintended processing, disclosure, or cross-skill propagation of student data.

Vague Triggers

Low
Confidence
82% confidence
Finding
The trigger timing section lists many valid use cases but does not define clear non-trigger cases or scope exclusions, so the orchestration layer may invoke this skill for ambiguous requests that do not require sensitive student analysis. Because the skill can generate class reports, individual diagnostics, and downstream writes to other skills, missing negative boundaries raises the risk of unnecessary activation and over-collection or over-sharing of educational records.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.