Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent math-coaching skill, but its optional GitHub sync, public Pages publishing, deploy-key setup, and scheduled jobs should be configured carefully because they can affect sensitive child learning records.
Use this skill in a dedicated personal learning repository. Keep GitHub sync disabled unless you intend to back up the full learning archive, keep repositories private unless you are deliberately publishing only public-safe worksheet pages, review `.zhizhi-math-coach/config.json` before enabling auto-sync or auto-publish, and verify any deploy key or cron job is scoped to this learning workspace only.
Automated fetching, committing, and pushing of learning records is high risk in a repository containing potentially sensitive child data. The danger is amplified by the instruction to perform sync from config-driven consent, which can normalize broad remote data transfer in a skill whose primary label suggests local educational assistance.
Automated fetching, committing, and pushing of learning records is high risk in a repository containing potentially sensitive child data. The danger is amplified by the instruction to perform sync from config-driven consent, which can normalize broad remote data transfer in a skill whose primary label suggests local educational assistance.
Automated fetching, committing, and pushing of learning records is high risk in a repository containing potentially sensitive child data. The danger is amplified by the instruction to perform sync from config-driven consent, which can normalize broad remote data transfer in a skill whose primary label suggests local educational assistance.
Automated fetching, committing, and pushing of learning records is high risk in a repository containing potentially sensitive child data. The danger is amplified by the instruction to perform sync from config-driven consent, which can normalize broad remote data transfer in a skill whose primary label suggests local educational assistance.
Automated fetching, committing, and pushing of learning records is high risk in a repository containing potentially sensitive child data. The danger is amplified by the instruction to perform sync from config-driven consent, which can normalize broad remote data transfer in a skill whose primary label suggests local educational assistance.
Automated fetching, committing, and pushing of learning records is high risk in a repository containing potentially sensitive child data. The danger is amplified by the instruction to perform sync from config-driven consent, which can normalize broad remote data transfer in a skill whose primary label suggests local educational assistance.
Automated fetching, committing, and pushing of learning records is high risk in a repository containing potentially sensitive child data. The danger is amplified by the instruction to perform sync from config-driven consent, which can normalize broad remote data transfer in a skill whose primary label suggests local educational assistance.
Automated fetching, committing, and pushing of learning records is high risk in a repository containing potentially sensitive child data. The danger is amplified by the instruction to perform sync from config-driven consent, which can normalize broad remote data transfer in a skill whose primary label suggests local educational assistance.
Automated fetching, committing, and pushing of learning records is high risk in a repository containing potentially sensitive child data. The danger is amplified by the instruction to perform sync from config-driven consent, which can normalize broad remote data transfer in a skill whose primary label suggests local educational assistance.
Automated fetching, committing, and pushing of learning records is high risk in a repository containing potentially sensitive child data. The danger is amplified by the instruction to perform sync from config-driven consent, which can normalize broad remote data transfer in a skill whose primary label suggests local educational assistance.
Automated fetching, committing, and pushing of learning records is high risk in a repository containing potentially sensitive child data. The danger is amplified by the instruction to perform sync from config-driven consent, which can normalize broad remote data transfer in a skill whose primary label suggests local educational assistance.
Automated fetching, committing, and pushing of learning records is high risk in a repository containing potentially sensitive child data. The danger is amplified by the instruction to perform sync from config-driven consent, which can normalize broad remote data transfer in a skill whose primary label suggests local educational assistance.
Automated fetching, committing, and pushing of learning records is high risk in a repository containing potentially sensitive child data. The danger is amplified by the instruction to perform sync from config-driven consent, which can normalize broad remote data transfer in a skill whose primary label suggests local educational assistance.
Automated fetching, committing, and pushing of learning records is high risk in a repository containing potentially sensitive child data. The danger is amplified by the instruction to perform sync from config-driven consent, which can normalize broad remote data transfer in a skill whose primary label suggests local educational assistance.
Automated fetching, committing, and pushing of learning records is high risk in a repository containing potentially sensitive child data. The danger is amplified by the instruction to perform sync from config-driven consent, which can normalize broad remote data transfer in a skill whose primary label suggests local educational assistance.
Automated fetching, committing, and pushing of learning records is high risk in a repository containing potentially sensitive child data. The danger is amplified by the instruction to perform sync from config-driven consent, which can normalize broad remote data transfer in a skill whose primary label suggests local educational assistance.
Automated fetching, committing, and pushing of learning records is high risk in a repository containing potentially sensitive child data. The danger is amplified by the instruction to perform sync from config-driven consent, which can normalize broad remote data transfer in a skill whose primary label suggests local educational assistance.
Referenced artifact was not completely inspected
orksheet generation in one conversation. Load the companion's actual installed `SKILL.md` from the skill catalog before following it; do not require another use
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
If the current workspace appears to be the reusable source repository `zhizhi-math-coach-openclaw` (for example it contains `docs/openclaw-release.md` and `examples/student-workspace/`), warn before writing student learning data. Do not warn merely because a personal workspace has an installed `skills/zhizhi-math-coach/` bundle from ClawHub. Only write student data into the source repository when the user explicitly says it is the intended personal learning workspace or the task is skill development with sanitized examples.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Winter break should repair first-semester weak points before previewing next semester.
- Summer break should review the whole school year before previewing the next grade.
## Output Rules
When using curriculum context, state:
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Winter break should repair first-semester weak points before previewing next semester.
- Summer break should review the whole school year before previewing the next grade.
## Output Rules
When using curriculum context, state:
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- `records/`, `mistakes/`, `memory/`, `weak-points/`, `knowledge-points/`, `curriculum/`;
- completed worksheet photos, school papers, textbook PDFs, scans, or OCR output.
## OpenClaw Output Rule
When Pages is configured, return the PDF file/path first, then the Pages URL when deployment is ready. Use the Pages URL in Feishu notifications when available, and send the PDF file when the channel supports file messages. Keep answer keys and diagnosis links outside published `site/` output.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Last Resort: HTTPS Token
Use HTTPS tokens only when deploy keys or SSH are not available. The parent should create a fine-grained GitHub personal access token (PAT) scoped to the personal learning repository only.
Recommended token settings:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Last Resort: HTTPS Token
Use HTTPS tokens only when deploy keys or SSH are not available. The parent should create a fine-grained GitHub personal access token (PAT) scoped to the personal learning repository only.
Recommended token settings:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Recommended token settings:
- Create path: GitHub web -> profile photo -> Settings -> Developer settings -> Personal access tokens -> Fine-grained tokens -> Generate new token.
- Token type: fine-grained personal access token.
- Resource owner: the GitHub user or organization that owns the personal learning repository.
- Repository access: `Only select repositories`, then select only the personal learning repository, such as `zhizhi-math-learning-data`.
Detected: suspicious.dynamic_code_execution