Generate Private K-12 School Client Education Handout

• Verdict: Pass
• Analyzed: May 1, 2026, 8:06 PM
• Findings: 0
• Version: 1.0.0
• Hash: 727c2acb63626cfcbe2ff88924fc7c9a3fecaa40a7f6620852b73f17fe691b0f
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: toby-generate-private-k-12-school-client-education-handout Version: 1.0.0 The skill bundle consists solely of metadata and markdown instructions (SKILL.md, README.md) for generating educational handouts for K-12 schools. It contains no executable code, no evidence of prompt injection for malicious purposes, and no instructions for data exfiltration or unauthorized system access. While it requests access to the 'Bash' tool, there are no commands or logic provided that would exploit this capability.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI02: Tool Misuse and Exploitation

NoteHigh Confidence

What this means

If used carelessly, the agent could read local files or run shell commands during a writing task, though no provided instruction tells it to do so.

Why it was flagged

The skill grants local shell and file-read tools even though the documented workflow is to draft an education handout and generate visuals. The artifacts do not instruct unsafe command execution, but the capability is broader than clearly needed.

Skill content

allowed-tools: Bash, Read

Recommendation

Use the skill only for the stated drafting task and avoid letting it run shell commands or read unrelated local files unless you explicitly need that.

ASI04: Agentic Supply Chain Vulnerabilities

NoteHigh Confidence

What this means

Following the README literally could lead a user to install from a different package or repository than the one represented by the registry entry under review.

Why it was flagged

The README install examples reference a qiaomu-named package/repository, while the registry metadata identifies the evaluated slug as toby-generate-private-k-12-school-client-education-handout. This is a provenance mismatch users should verify.

Skill content

clawhub install qiaomu-generate-private-k-12-school-client-education-handout ... git clone https://github.com/qiaomucom/generate-private-k-12-school-client-education-handout.git

Recommendation

Install only from a trusted ClawHub entry or repository after confirming the slug, owner, and file contents match the skill you intend to use.