Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Chinese lesson-plan drafting helper with an optional local Python script, and the risky scan findings mostly point to dormant generic code that is not enabled by the packaged configuration.
Install only if you are comfortable with a Chinese-language lesson-planning helper that may run a local python3 script over an input file you choose. Use normal mode with the packaged spec.json, avoid feeding sensitive student or personal data unless redacted, and do not repurpose the dormant audit modes for broad filesystem scanning without separate review.
声明描述的是教育内容生成类技能，但代码并未体现任何与课程目标、教案生成、互动题生成、作业设计或分层教学建议相关的专门逻辑。相反，脚本从 resources/spec.json 读取配置后，按 mode 执行多种审计/扫描任务：directory_audit 会遍历目录和文本文件；csv_audit 会读取表格并统计字段；pattern_audit 会搜索 curl|bash、rm -rf、secret/token/private_url 等风险模式；skill_audit 会检查技能目录中的必需文件和 SKILL.md frontmatter。虽然也有 structured_brief 这种通用模板化输出，但本质仍是通用报告框架，而不是教育工作流生成器。因此其主要用途与声明明显不符，且具备多项未声明的审计扫描能力，应判定为描述与行为不匹配。
The script implements directory auditing, pattern-based security scanning, and skill-package compliance checks that are unrelated to the declared educational purpose of generating lesson materials. This capability mismatch is dangerous because it enables inspection of arbitrary local files and repositories via user-supplied paths, expanding the skill's access and creating opportunity for unauthorized discovery of sensitive information.
The pattern scanning logic searches arbitrary files for secrets, internal URLs, and dangerous shell patterns, which constitutes security scanning functionality not justified by the skill's classroom-use description. In an educational skill, this hidden dual-use behavior increases risk of data exposure and covert reconnaissance against local content the user did not intend to analyze for security purposes.
The entire skill description, examples, and interface guidance are presented only in Chinese, with no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-language context. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.
The trigger section lists natural-language examples like '根据教学目标生成教案' and especially '补互动题和作业', which are broad task phrases a user might say in normal conversation. The README does not provide tighter routing constraints, explicit invocation boundaries, or negative examples to distinguish when this skill should activate versus when it should not.
The skill declares executable capability requirements (python3) and documents file/script-based operation, but does not explicitly constrain tool scope with permissions or allowed-tools. That creates ambiguity about what runtime actions are permitted and can lead an agent or platform to grant broader file and shell access than is necessary for a lesson-plan skill.
The skill claims to be 'default read-only' and to prefer review/dry-run behavior, yet it explicitly instructs execution of a local Python script that reads inputs and writes outputs. This contradiction can mislead reviewers and users about the real operational risk, increasing the chance that code execution and file writes occur in contexts assumed to be non-executing.
A lesson-plan generation skill does not inherently require shell or Python execution; introducing python3 script invocation expands the attack surface to code execution, file access, and potential abuse of local environment capabilities. In this context, executable behavior is more dangerous because the declared use case is simple content generation that could be performed without runtime code.
This markdown file presents all user-facing content in Chinese, and there is no indication that the user can opt into another language or that the skill is intentionally restricted to a Chinese-language context. Under the policy rule for natural-language violations, forcing a specific language without user choice can be a locale-policy issue.
The generated report strings are written in Chinese (for example, headings and guidance text), which forces a specific language on users. This is a natural-language policy concern because the script does not offer any language choice or document a justified locale restriction.
The directory and skill-audit functions enumerate arbitrary files, inspect Markdown headings, and assess package structure beyond the stated lesson-planning purpose. While less severe than direct secret extraction, this still broadens filesystem visibility and can leak repository structure, filenames, and document content samples to outputs.
Directory, CSV, and pattern audit reports emit Chinese-only headings and instructions. Because the script produces user-facing natural-language output across multiple modes without any opt-in or configuration, it violates the language/locale policy criterion.
Frontmatter validation errors and skill audit report sections are emitted only in Chinese, again enforcing a specific language. There is no evidence of user choice or a documented regional justification for this constraint.
The smoke test content is entirely in Chinese and the expected output sections are specified only in Chinese, which indicates a language-specific requirement. The file does not state that the skill is region-specific or that users may choose another language, so this appears to force a locale without opt-in.
This file presents all natural-language content exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into this language. Under the policy, forcing a specific language without user choice can be a locale/language policy violation.
The description string is partly in Chinese and partly in English, which imposes mixed-language behavior without any stated user opt-in or language selection. This can violate a language/locale policy when skills are expected to respect the user's preferred language unless explicitly documented.
This markdown file presents the skill input and instructions entirely in Chinese, which may effectively force a specific language for users without any stated opt-in or explanation. The policy for natural-language violations applies to all file types and flags language constraints that are not optional or justified.
No suspicious patterns detected.
