Chinese Tutor

Security checks across malware telemetry and agentic risk

Overview

This Mandarin tutoring skill is instruction-only and its saved learner progress is aligned with tutoring, but users should understand it keeps local profile and lesson-history files.

Install this if you want recurring Chinese lessons with saved progress. Review or delete the generated hinihao profile, grammar, lesson, and archive files if you do not want long-term retention, and avoid uploading private documents or images unless saving derived learning notes is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs the agent to create and maintain a persistent learner profile file containing preferences, schedule, interests, lesson history, and progress data without any explicit user notice or consent flow. Silent persistence is dangerous because users may not realize their behavioral and learning data is being stored across sessions, which creates privacy, retention, and transparency risks even if the data is not highly sensitive.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The archival logic says vocab and lesson history should be archived automatically and 'silently,' which extends retention of user data without informing the learner. This is risky because archived files can preserve more historical data than users expect, increasing exposure in the event of misuse, leakage, or later secondary use.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The template directs the agent to persist learner data into profile, grammar, and lesson files without any consent, notice, retention policy, or data-minimization guardrails. In a tutoring context, this can silently accumulate personal learning history and uploaded document contents, creating privacy and compliance risk if users are unaware that their data is being stored long-term.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal