Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent English listening practice skill that fetches lesson material from disclosed ESL sources and does not install code, persist data, or request sensitive access.
Install this if you want an agent to run structured English listening lessons and fetch public ESL passages. Be aware that broad prompts like asking for an English lesson may trigger a full interactive session, including external web fetching from the listed learning sites.
The README instructs the agent to trigger this skill for very broad, everyday study phrases such as 'give me an English lesson' or 'help me practice listening,' and even says to trigger for casual requests. Overly broad activation can cause the skill to hijack unrelated conversations or override more appropriate skills, leading to unintended fetching of external content and unexpected agent behavior.
The skill description contains very broad activation phrases such as general requests for English practice, lessons, studying, or listening help. This can cause the agent to invoke the skill during ordinary conversation where the user did not explicitly request this workflow, leading to unintended web fetching, over-collection of conversational context for adaptation, and user experience or policy bypass issues through inappropriate tool use.
The scope language says to use the skill whenever a user wants to study English from text or audio, but it does not define boundaries for when this skill should defer to translation, tutoring, summarization, or general conversation behaviors. This ambiguity increases the chance of misrouting user requests and invoking external-content workflows in contexts the user did not intend.
The file frames the skill as an 'English Listening Coach' and instructs use of English-learning content sources without offering a language choice or documenting a justified locale restriction. This is a natural-language locale policy constraint that appears mandatory rather than opt-in.
The README presents the skill exclusively as an "English Listening Coach" and repeatedly directs use for English lessons and practice, but it does not mention any option for user language preference or opt-in around language/locale constraints. This can be a natural-language policy concern when a skill hard-codes a language experience without documenting choice or justification.
No suspicious patterns detected.
