Security audit
Security checks across malware telemetry and agentic risk
This skill appears intended for math coaching, but it also enables high-impact GitHub sync, public publishing, SSH configuration, and scheduled automation around a child's learning records.
Install only if you want a local-first math coaching workspace that may also manage GitHub sync, public worksheet links, SSH deploy keys, and scheduled reminders. Before enabling cloud sync or Pages, verify the repository is private or that you are comfortable exposing committed learning files, and review .zhizhi-math-coach/config.json for auto-pull, auto-commit, auto-push, auto-publish, and cron settings.
7. Explain the correction in parent-friendly language, and include a shorter student-facing version when useful. 8. Generate short validation practice for the cause, not just the surface topic. 9. Update the mistake book, progress dashboard, weak-point records, memory, and next-practice suggestion only when evidence supports it. 10. If automatic Git sync, Pages publishing, or scheduled reminders are enabled in `.zhizhi-math-coach/config.json`, sync/publish/register supported automation without asking again after local files are written. ## Expected Workspace
- `scripts/prepare_github_deploy_key.py`: generate a repository-scoped SSH deploy key and public-key setup instructions for GitHub Deploy keys. - `scripts/setup_github_pages_workflow.py`: create `.github/workflows/pages.yml` for publishing `site/` through GitHub Actions. - `scripts/setup_scheduled_tasks.py`: enable automation config and register OpenClaw cron reminder jobs when `openclaw cron` is available. - `scripts/sync_learning_repo.py`: pull, commit, and push configured learning-data changes without asking again when automatic sync is enabled. - `references/daily-grading-workflow.md`: fast grading, light recording, automatic full-archive upgrade, subagent boundary, validation, recording, and grading sync. - `scripts/build_grading_context.py`: build one compact grading context from config, active context, and curriculum profile. - `scripts/validate_diagnosis_payload.py`: validate diagnosis JSON before writing records.
Read `references/daily-grading-workflow.md`. Default daily grading is one-turn `fast_grade_light_record`: grade the photo or wrong-question batch, return the parent-facing summary, and write a light local record without asking the parent for another message. Use `fast_grade_only` only when the parent explicitly says not to record. Upgrade yourself to `full_archive` when the evidence justifies it; do not wait for the parent to say "完整归档". Build compact context first:
The push triggers the GitHub Actions Pages deployment. Return the expected URL `https://<github-user>.github.io/<repo>/` and tell the parent that the first deployment may take a short time. In normal worksheet generation, first return or send the generated `worksheet.pdf` when available. If Pages mode is already configured in `.zhizhi-math-coach/config.json`, run `publish_and_wait_pages.py` after `generate_worksheet.py` without asking again when `pages.auto_publish_worksheets` is true. Otherwise run it only when a public link is wanted. Return: - the public index URL; - the newly generated worksheet URL;
public_key = public_key_for(key_path)
if not args.no_ssh_config:
update_ssh_config(Path.home() / ".ssh" / "config", host_alias, key_path, owner, repo)
remote_url = f"git@{host_alias}:{owner}/{repo}.git"
if args.configure_remote:65/65 vendors flagged this skill as clean.
Detected: suspicious.dynamic_code_execution