Skillv1.0.0

ClawScan security

教师教学能力动态评估Skill · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

BenignApr 24, 2026, 6:15 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's declared purpose (teacher evaluation and classroom/teacher comparison) aligns with the provided instructions and reference documents; it is an instruction-only spec that does not request unexpected credentials or installs.
Guidance: This skill appears internally consistent with its stated goal of generating teacher and class comparison charts from student mastery data. Before installing or deploying, verify: (1) the provenance and trustworthiness of the upstream homework-grading-assessment skill (it supplies the student data); (2) privacy and compliance — ensure consent, PII protections, and anonymization settings are configured as intended; (3) who can export or migrate data and whether exports are encrypted/audited; (4) how the skill will be integrated (APIs, database access, file import/export) and what real credentials or storage access will be granted at runtime. Also note the commercial license text — commercial use may require a contract with the vendor. If you want a deeper review, provide the integration points (what APIs or storage the skill will read/write) and any implementation code that will run in your environment.

Review Dimensions

Purpose & Capability: okThe name/description match the content of SKILL.md and the reference docs — all files describe charts, data models, permission rules and mapping logic that are appropriate for a teacher-capacity evaluation system. The declared dependency on homework-grading-assessment output is coherent with the stated purpose.
Instruction Scope: noteThe SKILL.md stays within the stated scope (consuming student/class KP mastery data and producing charts/reports). Note: the skill implies access to student and teacher records and supports data export/migration and anonymization options — these are expected for this domain but represent sensitive data handling that implementers must secure and audit.
Install Mechanism: okInstruction-only skill with no install spec and no code files — nothing is written to disk or downloaded by the skill itself, which minimizes install-time risk.
Credentials: okThe skill declares no environment variables, no external credentials, and no config paths. The data access it needs is internal (outputs from the homework-grading-assessment skill); that is proportionate to its purpose. If integrated into a real deployment, appropriate service credentials and access controls will be needed, but they are not requested here.
Persistence & Privilege: okThe skill does not request always: true and contains no install hooks or instructions to change other skills' configurations. It documents data export and migration features (normal for this domain) but does not itself request persistent elevated privileges.