Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local student-score report generator with disclosed file and command use, and I did not find hidden persistence, credential access, network retrieval, or destructive behavior.
Before installing, confirm you are comfortable giving the agent access to the student score spreadsheet and local report output directory. Review generated conclusions for unsupported causal claims, and approve any system package installation such as fonts-noto-cjk only if you actually need it.
The file title and core instructions are written as a Chinese-only reporting prompt and direct the model to generate the analysis report in that form. There is no indication that the user may choose another language or that the Chinese-only requirement is justified as a region-specific constraint.
Early instructions require evidence-based diagnosis and explicitly prohibit causal claims unless the data source contains the relevant information. However, the later sample output states root causes like '数学基础薄弱，学习兴趣不足' as if they were established findings, which contradicts the earlier prohibition on unsupported causal reasoning.
The manifest describes a Python-based local score analysis and report generation workflow using pandas/matplotlib, with no need for external tools during execution. This prompt explicitly tells the model to run grep -c ... on a report file, introducing shell-command execution capability that is not an obvious requirement of analyzing Excel score data or writing reports.
No suspicious patterns detected.
