Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Industry Research Maching Engine

v1.0.3

你的核心任务是:接收用户输入的【本科专业】,通过“政策-学术-就业”三维逻辑,输出一份**绝对客对客观**的考研专业与院校方向选择指导报告。

0· 85·0 current·0 all-time
byTsingliu@tsingliuwin
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name, description, SKILL.md workflow and included references consistently focus on mapping undergraduate majors to industry/academic/employment data — the requested behavior matches the stated purpose. However, the SKILL.md explicitly requires live searches via specific skills (baidu-search and web_fetch) and strict provenance checks while the skill manifest declares no dependencies, no homepage, and an unknown source, which is an inconsistency about how the skill expects to obtain data.
!
Instruction Scope
The runtime instructions require real-time retrieval of university program lists, admissions plans and job descriptions from研招网, university sites and major job platforms, and forbid simulated data. They explicitly instruct the agent to call baidu-search and web_fetch. This is coherent with the goal but raises two concerns: (1) the skill assumes availability and correct behavior of those external search/fetch skills (not declared), and (2) live web fetching increases the platform/network attack surface and may produce unexpected data flows if the invoked fetch skills have different privileges or logging policies.
Install Mechanism
Instruction-only skill with no install spec and no code files — low disk footprint and no archive downloads. This is the lowest-risk install model.
Credentials
The manifest requests no environment variables or credentials, which is appropriate for a research/reporting skill. However, the SKILL.md expects networked fetches; those other skills or platform connectors (baidu-search, web_fetch) may require API keys or network permissions not declared here. The absence of declared network/skill dependencies is a proportionality/visibility gap.
Persistence & Privilege
always is false and there is no indication the skill requests persistent system privileges or modifies other skills' configurations. It doesn't request to run autonomously beyond the platform default, which is normal.
What to consider before installing
Before installing, consider the following: - Missing declared dependencies: SKILL.md requires baidu-search and web_fetch for live retrievals, but the skill manifest does not declare these dependencies. Confirm your agent platform provides those skills and inspect their permissions and privacy policies. - Unknown source & no homepage: The skill owner and source are unknown and there is no homepage or external repo. Prefer skills with clear provenance or review the maintainers before trusting data-critical outputs. - Network/data flow: The skill's core requirement is to fetch live data from研招网, university websites and job platforms. Ensure you are comfortable with the agent making outbound web requests and that web_fetch/baidu-search won't leak sensitive context or logs to third parties. - Reproducibility & audit: Because the skill forbids simulated data, verify that the invoked search/fetch skills actually return verifiable citations. If the platform cannot guarantee live web access, the skill may hallucinate despite its instructions. - Test safely: Try the skill with non-sensitive, low-impact queries first and manually verify a few cited sources. If you need stronger assurance, ask the maintainer for a homepage/repo and a list of declared dependencies (or provide your own verified connectors for web_fetch/baidu-search). - If you require stricter controls (no outbound web access, or logging restrictions), do not install this skill until those controls can be enforced. Overall: functionally coherent for its purpose, but the undeclared runtime dependency on internet-fetching skills and the unknown provenance make it suspicious — verify dependencies, platform network policies, and the skill's origin before use.

Like a lobster shell, security has layers — review code before you run it.

latestvk97f7xxkkp9qtjah7z7mwj4mps83jgwc

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments