Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently helps teachers generate local study-guide and quiz HTML files, with disclosed local browser storage and no evidence of hidden execution, exfiltration, or privilege-seeking behavior.
Install only if you want a Chinese-language teaching helper that generates single-file HTML study and quiz pages. Share generated HTML and imported progress JSON only between trusted teachers and students, because local HTML can run JavaScript and imported JSON can affect saved quiz progress.
The trigger phrases are broad enough to match many ordinary education-related requests, which can cause the skill to activate when the user did not specifically ask for this tool. Over-broad routing increases the chance of unintended behavior, content hijacking, or suppression of better-matched skills, especially because the skill generates executable HTML/JS artifacts from user-provided materials.
The skill promotes distributing AI-generated local HTML files that use browser localStorage and JSON import/export, but it does not warn teachers or students about the trust boundary this creates. Opening untrusted HTML locally can still execute JavaScript, manipulate locally stored study data, and import malformed or hostile JSON that causes data loss, spoofed content, or privacy leakage if users share exported progress files.
The skill's display name and core description are entirely in Chinese, and the document does not indicate that users may choose another language or locale. This can constitute a language policy issue when the skill implicitly assumes one language for all users without documenting opt-in or regional limitation.
