Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent child-English-homework helper that creates an interactive HTML lesson, with microphone and file-output behavior that should be understood before use.
Install only if you expect it to analyze children’s English homework images and create downloadable HTML lesson files. Review the generated page before a child uses it, and be aware that speech practice may ask Chrome for microphone permission and may rely on the browser’s speech-recognition behavior.
The skill description contains broad trigger phrases like '幫我做一個學習頁' combined with any attached image, which can cause the agent to invoke this skill for loosely related requests outside its intended scope. Over-broad activation increases the chance of unintended image analysis, HTML generation, and file creation when the user did not clearly request those actions.
The skill prominently includes microphone-based speech recognition and instructs users to allow mic access, but the description lacks an upfront privacy notice about audio capture and browser speech-recognition handling. For a child-focused skill, this omission is more sensitive because parents may not expect mic use or understand whether audio is processed locally or by the browser/platform.
The skill instructs the agent to save a generated HTML file to disk and return it, but the skill description does not clearly warn users up front that a file will be created. This can lead to unexpected persistence of user-derived content and surprise file generation, especially when triggered automatically from an uploaded image.
No suspicious patterns detected.
