Skip to content
← Registry
Trust Report

baoyu-comic

Knowledge comic creator supporting multiple art styles and tones. Creates original educational comics with detailed panel layouts and sequential image generation. Use when user asks to create "知识漫画", "教育漫画", "biography comic", "tutorial comic", or "Logicomix-style comic".

71
SUSPICIOUS
Format: openclawScanner: v0.7.1Duration: 17msScanned: 7d ago · Apr 2, 5:53 AMSource →
Embed this badge
AgentVerus SUSPICIOUS 71AgentVerus SUSPICIOUS 71AgentVerus SUSPICIOUS 71
[![AgentVerus](https://agentverus.ai/api/v1/skill/276f0d51-594c-42d5-916b-f6fa36742399/badge)](https://agentverus.ai/skill/276f0d51-594c-42d5-916b-f6fa36742399)
Community Discussion

Community Comments

Public comments are the active feedback surface on skill reports right now. Use them to share implementation notes, edge cases, and operator context.

0 comments

Sign in to comment on this skill

No comments yet. Be the first to share your thoughts.

Continue the workflow

Keep this report moving through the activation path: rescan from the submit flow, capture real-world interactions, and wire the trust endpoint into your automation.

https://agentverus.ai/api/v1/skill/276f0d51-594c-42d5-916b-f6fa36742399/trust
Personalized next commands

Use these current-skill command blocks to keep this exact report moving through your workflow.

Record an interaction
curl -X POST https://agentverus.ai/api/v1/interactions \
  -H "Authorization: Bearer at_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"agentPlatform":"openclaw","skillId":"276f0d51-594c-42d5-916b-f6fa36742399","interactedAt":"2026-03-15T12:00:00Z","outcome":"success"}'
Fetch trust JSON
curl https://agentverus.ai/api/v1/skill/276f0d51-594c-42d5-916b-f6fa36742399/trust

Category Scores

14
Permissions
100
Injection
92
Dependencies
0
Behavioral
70
Content
100
Code Safety

Findings (26)

highCapability contract mismatch: inferred command execution is not declared-12

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: Exec

Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03
highCapability contract mismatch: inferred file read is not declared-6

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: references/

Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03
highCapability contract mismatch: inferred filesystem discovery is not declared-8

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: {baseDir}

Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03
highCapability contract mismatch: inferred configuration override is not declared-10

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: EXTEND.md

Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03
highCapability contract mismatch: inferred network access is not declared-6

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: https://github.com/JimLiu/baoyu-skills#baoyu-comic

Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-04
highCapability contract mismatch: inferred process orchestration is not declared-8

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: Script path = `{baseDir}/scripts/

Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03
highCapability contract mismatch: inferred documentation ingestion is not declared-10

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: references/

Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03
highCapability contract mismatch: inferred package bootstrap is not declared-10

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: npx -y bun

Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03
highCapability contract mismatch: inferred prompt file ingestion is not declared-8

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: reference images

Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03
highMedia artifact handoff dependency-8

The skill depends on local images, videos, thumbnails, or other media artifacts being passed into remote or browser-driven workflows, expanding the data-handoff surface.

image generation

Review which external services or providers the skill depends on, what data crosses that boundary, and whether the dependency is necessary for the intended workflow.

dependenciesASST-04
highSystem modification detected-20

Found system modification pattern: "suggest installing bun"

4. Resolve `${BUN_X}` runtime: if `bun` installed → `bun`; if `npx` available → `npx -y bun`; else suggest installing bun

Skills should not modify system configuration or install packages globally. Bundle required dependencies.

behavioralASST-03
highLocal file access detected-15

Found local file access pattern: "EXTEND.md"

2. EXTEND.md `language` setting

Treat local file browsing as privileged access. Restrict it to explicit user-approved paths and avoid combining it with unrestricted browser/session reuse.

behavioralASST-03
highLocal file access detected (inside code block)-15

Found local file access pattern: "$HOME/.baoyu-skills/baoyu-comic/EXTEND.md"

| `$HOME/.baoyu-skills/baoyu-comic/EXTEND.md` | User home |

Treat local file browsing as privileged access. Restrict it to explicit user-approved paths and avoid combining it with unrestricted browser/session reuse.

behavioralASST-03
highLocal file access detected (inside code block)-15

Found local file access pattern: ".baoyu-skills/"

| `.baoyu-skills/baoyu-comic/EXTEND.md` | Project directory |

Treat local file browsing as privileged access. Restrict it to explicit user-approved paths and avoid combining it with unrestricted browser/session reuse.

behavioralASST-03
highLocal file access detected-15

Found local file access pattern: "[references/partial-workflows.md](references/partial-workflows.md)"

Details: [references/partial-workflows.md](references/partial-workflows.md)

Treat local file browsing as privileged access. Restrict it to explicit user-approved paths and avoid combining it with unrestricted browser/session reuse.

behavioralASST-03
highLocal file access detected-15

Found local file access pattern: "references/"

Details: [references/partial-workflows.md](references/partial-workflows.md)

Treat local file browsing as privileged access. Restrict it to explicit user-approved paths and avoid combining it with unrestricted browser/session reuse.

behavioralASST-03
highLocal file access detected-15

Found local file access pattern: "reference images"

- If the chosen skill supports reference images, pass `characters/characters.png` as `--ref`

Treat local file browsing as privileged access. Restrict it to explicit user-approved paths and avoid combining it with unrestricted browser/session reuse.

behavioralASST-03
highLocal file access detected (inside code block)-15

Found local file access pattern: "--ref characters/characters.png"

- [ ] 7.2 Generate pages WITH --ref characters/characters.png

Treat local file browsing as privileged access. Restrict it to explicit user-approved paths and avoid combining it with unrestricted browser/session reuse.

behavioralASST-03
highLocal file access detected (inside code block)-15

Found local file access pattern: "scripts/merge-to-pdf.ts"

| `scripts/merge-to-pdf.ts` | Merge comic pages into PDF |

Treat local file browsing as privileged access. Restrict it to explicit user-approved paths and avoid combining it with unrestricted browser/session reuse.

behavioralASST-03
highLocal file access detected-15

Found local file access pattern: "Script path = `{baseDir}/scripts/"

2. Script path = `{baseDir}/scripts/<script-name>.ts`

Treat local file browsing as privileged access. Restrict it to explicit user-approved paths and avoid combining it with unrestricted browser/session reuse.

behavioralASST-03
highExternal instruction override file detected-15

Found external instruction override file pattern: "EXTEND.md" Merged overlapping signals from the repeated finding family: - External instruction override file detected

2. EXTEND.md `language` setting

Be explicit when external project/home files can override skill behavior. Treat sidecar config or instruction files as untrusted input and constrain what they are allowed to change.

behavioralASST-11
highPackage bootstrap execution detected (inside code block)-15

Found package bootstrap execution pattern: "npx -y bun"

4. Resolve `${BUN_X}` runtime: if `bun` installed → `bun`; if `npx` available → `npx -y bun`; else suggest installing bun

Surface package bootstrap commands for review. Ephemeral package execution and install-time dependency pulls increase supply-chain risk, especially when versions are not pinned or provenance is unclear.

behavioralASST-04
highSkill path discovery detected-15

Found skill path discovery pattern: "Determine this SKILL.md file's directory path" Merged overlapping signals from the repeated finding family: - Skill path discovery detected

1. Determine this SKILL.md file's directory path as `{baseDir}`

Treat dynamic skill path resolution and installation-path discovery as local filesystem reconnaissance. Scope which paths may be read or executed from, and avoid broad path probing unless the user explicitly requested it.

behavioralASST-03
highExternal AI provider delegation detected-15

Found external ai provider delegation pattern: "reference images" Merged overlapping signals from the repeated finding family: - External AI provider delegation detected

- If the chosen skill supports reference images, pass `characters/characters.png` as `--ref`

Treat external AI-provider calls as data egress. Make it explicit what prompts, files, or images are sent to third-party providers and require approval before forwarding sensitive content.

behavioralASST-02
mediumCapability contract mismatch: inferred file write is not declared-8

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: Save output

Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03
lowNo explicit safety boundaries-10

The skill does not include explicit safety boundaries defining what it should NOT do.

No safety boundary patterns found

Add a 'Safety Boundaries' section listing what the skill must NOT do (e.g., no file deletion, no network access beyond needed APIs).

contentASST-09