ClawHub
Back to skill

Security audit

Hk School Selection

Security checks across malware telemetry and agentic risk

Overview

This is a static Hong Kong school-selection guide with no code or permissions, but its school data is limited and should be independently verified.

Safe to install from a security standpoint, but use it only as a planning aid. Before making school applications, confirm school status, admissions dates, fees, language support, and Banding information with official Education Bureau sources or the schools directly.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The README markets the skill as covering 512 schools, but the documented data files only describe a much smaller dataset of roughly 37–38 schools. This mismatch can mislead users into relying on incomplete school coverage for real education decisions, creating integrity and trust risks even though it is not a code-execution issue.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The report states the skill claims a structured dataset of 512 schools, but the actual `schools.json` file is missing or empty. This creates a material integrity gap: users may rely on advertised queryable school data that does not exist, leading to misleading recommendations, unverifiable outputs, and unsafe decision-making for school applications.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The recommendation to add a disclaimer indicates the current skill presentation overstates data freshness and accuracy relative to reality. In a school-selection context, stale or inaccurate school status information can mislead families into applying to closed, merged, or changed schools, causing real-world harm even if the issue is not a classic code exploit.

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
The template hard-codes a specific target profile (「不會粵語、英語較弱、數學較強的女生」) as the default applicable audience without any indication that this should be selected only when relevant. This can bias outputs toward assumptions about language ability, gender, and academic strengths, leading to inappropriate or discriminatory recommendations when reused for other students.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.