French Learning

Before installing or running this skill: - Verify gog, gemini, and sag are the exact CLIs you expect and are installed from trusted sources. CLI supply-chain risk is real. - Confirm how your machine is authenticated to Google (gog). The skill will read and write Google Sheets and upload files to Drive; the repository does not declare the Google credentials/config required — ensure you only grant a least-privilege account or folder access, not broad account access. - Protect API keys: GEMINI_API_KEY and ELEVENLABS_API_KEY are required; treat them as secrets and avoid exposing them to shared environments. - Review and harden scripts: replace the shell=True pattern in scripts/fix_update.py (which injects /tmp/french_learning_output_data.json via a shell substitution) with a safe non-shell subprocess call that reads the file directly or passes JSON as an argument. The current pattern could allow command injection if an attacker can control the temp file. - Consider running first in a sandbox or with a restricted Google service account that only has write access to the intended Sheet/Drive folder, and audit the folder after a test run. - If you do not want the skill to upload to your Drive, do not provide the Drive Folder ID or run the generate_audio script until you have validated outputs locally. If you want, I can point out the exact lines to change to eliminate the shell invocation and make the scripts safer.