Security audit
Security checks for vulnerabilities and agentic risk
This tutoring skill is mostly coherent, but it stores student learning data, photo-derived OCR content, and optional Feishu credentials with weak consent and retention boundaries.
Review this skill before installing. It is not evidence of malware, but users should avoid putting real Feishu tokens into plain profile files unless they understand the exposure risk, and should only upload study images they are comfortable having OCR text saved from. Prefer local CSV storage, limited-scope Feishu credentials, and manual confirmation before saving photo-derived or mastery-update records.
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
**Core Principles:**
- Don't lecture rules directly, let student discover first
- Analyze why wrong, not just give the answer
- Use positive feedback, not criticism
The setup prompt and many trigger phrases are written only in Chinese, effectively constraining the skill to Chinese-language interaction. The file does not offer the user a language choice or explicitly justify the locale restriction as a documented regional requirement.
The skill instructs automatic creation of workspace directories and CSV files without explicit user consent at the moment of modification. This can lead to unexpected writes to local storage, persistence of student data, and silent accumulation of personal learning records in the workspace.
The skill handles Feishu API setup, including App Token and Table IDs, without an explicit privacy or secret-handling warning. Collecting and storing service tokens in workspace memory creates a real risk of credential exposure, unauthorized data access, and leakage of student records if the workspace is shared or logs are exposed.
The trigger table includes the standalone phrase "复习" as an activation condition for reviewing wrong questions. This is ambiguous because users may say "复习" in many contexts that do not specifically mean invoking the wrong-question review workflow, and the file does not provide exclusion conditions or negative examples.
Automatically treating any photo as OCR input and then saving extracted content can cause unintended ingestion of sensitive data from unrelated images. In this skill, that means private student information, screenshots, or non-study content could be parsed and persisted without explicit confirmation.
The skill treats broad natural-language phrases like '记住了', '会了', '没掌握', and '忘了' as state-changing triggers for memory progression/reset. In an educational chat context, these phrases can appear casually or ambiguously, causing unintended updates to study records and spaced-repetition schedules without clear confirmation. The context makes this more dangerous because students are likely to use exactly these everyday phrases while asking for help, so accidental mastery inflation or reset is plausible and can degrade learning accuracy over time.
The document instructs the agent to perform OCR on student-submitted photos and persist extracted content, but it does not specify any notice, consent, minimization, or handling rules for images and derived text. Student photos may contain personal data, school information, handwriting, or unrelated background content, so silent OCR and storage can create privacy and data-governance risks. Because the target users are high school students, the sensitivity is elevated and safer-by-default handling is expected.
The template asks learners to provide a Feishu App Token and table identifiers directly in a profile document, but gives no guidance on secure handling, storage scope, least-privilege configuration, or the privacy implications of sharing credentials. In an educational skill used by students, this can lead to accidental exposure of API credentials or unauthorized access to linked study records if the document is shared, synced, or stored insecurely.
The entire template is written as a prescriptive Chinese-only workflow, including required feedback phrases and formatting, with no indication that the user can choose another language. This can violate language/locale policy because it forces a specific language without explicit opt-in or documented regional justification.
The template expands the skill from tutoring into persistent OCR-driven collection and storage of user-submitted content, including photo-derived text and vocabulary history. For a high-school education skill, this creates unnecessary data-retention and scope-creep risk, especially because students may upload homework, personal notes, or other sensitive material without clear consent or limits.
The skill instructs OCR ingestion of student photos and structured storage into tables even though the stated purpose is exam-prep tutoring, not record management. This mismatch increases privacy and data-handling risk because users may not expect their uploaded study materials to be classified and retained in a persistent datastore.
The file requires storing OCR/photo-derived content and queried vocabulary records without any user-facing privacy warning, consent flow, or retention policy. Because the target audience includes high-school students, silent retention of educational content is more sensitive and can undermine user trust or expose personal study materials if the backend is accessed improperly.
The entire skill is written to operate in Chinese for instruction and response flow, while also requiring English vocabulary prompts, without any opt-in or alternative language choice. This is a natural-language policy issue because it imposes a specific language/locale behavior on users rather than documenting a justified region-specific constraint or offering choice.
The natural-language content of the skill template is fully Chinese and does not indicate that language selection is optional or constrained to a China-specific audience. Per the policy, forcing a specific language without user opt-in can be a locale/language policy issue.
The file defines all user-facing field names in Chinese, which imposes a specific language/locale choice. Under the policy, locale-specific language is only acceptable when the skill offers user choice or clearly documents a justified regional constraint, neither of which is present in this file.
The CSV header and example value are entirely in Chinese, which imposes a specific language/locale in natural-language content. There is no accompanying note that this schema is intended only for Chinese-speaking users or that alternative locales are supported.
The CSV header is entirely in Chinese, which indicates a fixed language/locale for the skill artifact. There is no visible opt-in, alternative locale, or documentation in this file showing that the schema is intentionally region-specific, so it may violate the language-choice policy.
The markdown template is written to require Chinese headings, Chinese translations, and Chinese explanatory content by default, including the instruction to present examples with Chinese translations. This imposes a specific language/locale choice on all uses of the skill without indicating that users may opt into another language.
No suspicious patterns detected.