Ai Exam 授客AI智能考试

AI智能出题考试系统 - 基于文档自动生成考试、指派学员并查询结果

This package appears to implement the advertised exam workflow (upload document → AI generate questions → assign users → query results), but there are important inconsistencies you should address before using it: - The registry metadata declares no required environment variables, but the code needs APP_KEY, APP_SECRET, CORP_ID and a BASE_URL (and possibly DEPT_USER_ID). Confirm and set BASE_URL and credential env vars before running. - The skill will upload any local file you provide to the configured BASE_URL. Do not point it at sensitive system files or private documents unless you trust the remote endpoint. Prefer using a test account and non-sensitive documents first. - Verify the BASE_URL is a trusted service you control or trust. The source is unknown and there is no homepage; consider obtaining the code from a vetted source or running it in an isolated environment (network-restricted or sandbox) initially. - Limit the credentials used: create a service account with minimal permissions for the exam API rather than using broad organization admin credentials. - Review the code (api-client.js, config.js, exam-service.js) yourself or with someone you trust to ensure endpoints and behaviors match your expectations. If you cannot validate BASE_URL and the origin of this package, treat it as untrusted and avoid using it with sensitive data or production credentials.

Type: OpenClaw Skill Name: soke-ai-exam-skill Version: 0.1.0 The skill implements an AI-driven exam system that requires high-risk capabilities, including reading local files and performing external network requests. Specifically, 'exam-service.js' uses 'fs.createReadStream' to upload documents to a remote server, and 'api-client.js' manages sensitive application credentials (APP_KEY, APP_SECRET) retrieved from environment variables. While these behaviors are aligned with the stated purpose of generating exams from documents, the broad file access and the transmission of credentials to a configurable BASE_URL constitute significant security risks that could be exploited for data exfiltration if the agent is misdirected.