Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a disclosed English tutoring skill, but its package is malformed and may not install or run correctly.
Install only if you specifically want an American English tutor, and expect the publisher to fix the invalid manifest and broken index.js before the skill will run reliably. The stored onboarding preferences are ordinary for this purpose, but users who do not want learning preferences saved should avoid enabling it.
The description specifies a personalized 'American English tutor,' which imposes a specific language variant as the skill's behavior. Under the policy, locale or language constraints should be optional or clearly justified; this file does not offer a choice or explain why American English is required.
The file contains two competing module export styles, with the first module.exports = { async onCommand... block appearing unterminated before a second export default block begins. This can change or break the actual entrypoint the host loads, causing the documented onboarding logic to differ from runtime behavior and creating a supply-chain integrity issue where reviewers may assess one code path while another executes.
The onboarding text explicitly brands the skill as an "American English Tutor," which imposes a specific language variety. Elsewhere the file provides no opt-in, alternative locale choice, or justification for restricting the user to American English, matching the language/locale policy violation criteria.
The natural-language metadata labels the skill as an "American English Tutor" and describes it as an "American English training system," which imposes a specific language/locale variant by default. The file does not offer a user choice of English variant or explain why American English is required, which conflicts with the locale policy criteria.
No suspicious patterns detected.
