ClawHub
Back to skill

Security audit

高考志愿规划（打破信息差）

Security checks for vulnerabilities and agentic risk

Overview

This is a China Gaokao admissions-planning skill with disclosed web-research and intake steps, and no evidence of hidden code, persistence, credential use, exfiltration, or destructive behavior.

Install only if you want China Gaokao志愿填报 guidance. Be prepared to share score, province, subject track, preferences, and possibly eligibility or budget details; avoid sharing unnecessary identity documents. Treat outputs as planning references and verify final choices, deadlines, special-program eligibility, and tuition details with provincial exam authorities and official university admissions offices.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
96% confidence
Finding
The trigger list includes broad phrases like '上大学', '考大学', and generic admission-planning terms, which can cause the skill to activate for ordinary educational conversation rather than clear user intent to use this skill. Overbroad activation can misroute users into a specialized workflow, collect unnecessary personal data such as score, province, and household details, and reduce user control over which capability is being invoked.

Natural-Language Policy Violations

Medium
Confidence
82% confidence
Finding
The skill is hard-coded for Chinese-language, China-specific gaokao planning and states automatic recognition of China-specific admission modes without offering language choice or an explicit locale opt-in. This can cause the skill to activate for users who do not expect China-specific guidance, leading to confusing or inapplicable recommendations and potentially unnecessary collection of sensitive educational data under the wrong jurisdictional assumptions.

Static analysis

No suspicious patterns detected.