ClawHub
Back to skill

Security audit

English Homework Grader (G3-6)

Security checks for vulnerabilities and agentic risk

Overview

This is a prompt-only homework grading skill with limited usability scope concerns but no risky system access or hidden behavior.

Before installing, consider narrowing when this skill activates and whether feedback should follow the user's preferred language. It does not run code, install dependencies, access files, or transmit data.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger description is broad enough to activate on generic English proofreading or writing-review requests, not just elementary-school homework. That can cause misrouting to a highly specialized grading prompt, producing inappropriate assumptions about age, school context, scoring, and feedback style, which is a real prompt-scope/security weakness even if it is not directly malicious.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The skill mandates Chinese explanations and output formatting without checking the user's language preference. This can override user intent, reduce usability, and in some agent settings cause unintended disclosure or incorrect handling when the surrounding conversation expects another language, though the security impact is limited.

Static analysis

No suspicious patterns detected.