Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed academy-operations playbook that uses local notes and does not include hidden code, automatic external access, or unsafe installation behavior.
Before installing, users should be comfortable with the skill creating or using local academy notes under ~/academy/. Avoid storing sensitive student records, health information, payment card data, passwords, or raw private records there, and set clear preferences if you only want academy guidance on explicit requests.
This markdown file includes a trigger-like instruction that could match many ordinary requests for 'growth help' without specifying that it is limited to admissions or enrollment contexts. The lack of explicit constraints or negative examples increases the risk of unintended invocation.
The activation instructions are broad enough to trigger the skill on common terms like classes, students, teachers, cohorts, or enrollments, which can cause the skill to activate outside the user's intended scope. This creates a context-boundary problem: the agent may start applying academy-specific behavior, ask unnecessary follow-up questions, or shape responses based on inferred persistence preferences before the user has clearly requested academy support.
No suspicious patterns detected.
