Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed photo-based homework solver that creates a local HTML report, with minor usability and privacy cautions but no evidence of malicious behavior.
Install only if you want a Chinese-oriented study helper that may read uploaded problem images, fetch content from links you provide, and save a local HTML report. Avoid using it for sensitive exams or private material you do not want persisted in a report file.
The trigger list includes very generic phrases like '解题', '帮我解题', and 'solve this problem', which are likely to match ordinary user requests that were not intended to invoke this specific skill. Over-broad activation can cause unintended tool use, including image reading, web fetching, and file generation, increasing the chance of privacy issues or unexpected actions without clear user intent.
The skill instructs the agent to write photo-solver-report.html into the current working directory and present it to the user, but does not require prior notice or consent for file creation. Even though the file is user-facing, silent writes can surprise users, overwrite existing files, or persist sensitive problem content locally in environments where file creation has security or privacy implications.
The prescribed HTML template hard-codes lang="zh-CN" and Chinese-only report titling/content conventions, which imposes a specific language/locale by default. The skill does not state that users may choose another language or opt into Chinese output.
This markdown file contains user-facing natural-language instructions exclusively in Chinese, and there is no indication that the user can opt into another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy rule for language/locale constraints, forcing a specific language without user opt-in is a policy concern.
This markdown file is entirely written in Chinese and defines a taxonomy centered on Chinese school-subject conventions such as 语文、文言文 and 政治, without offering any language or locale choice. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation unless the regional constraint is explicitly documented and justified.
