Curriculum Generator

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the recommended dependency or packages expands what must be trusted beyond this skill itself.

Why it was flagged

The skill relies on an external skill and user-installed Python packages that are not part of this instruction-only package.

Skill content

- **neo-ddg-search skill**: For web searching educational resources
  - Install: `clawhub install neobotjan2026/neo-ddg-search`
...
  pip3 install pandas openpyxl

Recommendation

Install those dependencies only from trusted sources, and review the neo-ddg-search skill and package provenance before using them.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Curriculum topics or search terms may be shared with the search provider and visible in debug output.

Why it was flagged

The skill sends curriculum topics through another skill to an external search service, which is expected for resource discovery but is still an external data flow.

Skill content

For each topic in the curriculum:
1. Executes DuckDuckGo search via neo-ddg-search
2. Extracts educational URLs from results

Recommendation

Avoid including private student, teacher, or organization details in search terms; use debug mode only when you are comfortable showing search queries and URLs.

NoteHigh Confidence

ASI06: Memory and Context Poisoning

What this means

POD details, curriculum assumptions, or prior decisions could persist locally and influence later curriculum generation.

Why it was flagged

The artifact discloses persistent local memory that may store curriculum-related context for future use.

Skill content

- Local memory storage for continuous improvement
...
- **Memory**: `~/.openclaw/skills/curriculum-generator/memory/`

Recommendation

Review or clear the memory folder when information is outdated or sensitive, and avoid storing unnecessary personal data.

NoteMedium Confidence

ASI10: Rogue Agents

What this means

Curriculum generation or research work may continue as a background task during normal use.

Why it was flagged

The README states that the skill supports background task execution, but the artifacts do not show hidden, self-propagating, or autonomous behavior outside the curriculum workflow.

Skill content

- ✅ Background task execution support

Recommendation

Monitor long-running tasks and stop them if they are no longer needed.