Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently creates local math worksheets and answer keys, with some expected local storage of worksheet inputs and outputs that users should manage carefully.
Before installing, be aware that generated worksheets, answer keys, source photos, and answer manifests may be saved locally and could contain student work or personal information. Use a suitable output folder, avoid including unnecessary personal data, and delete old worksheet folders when they are no longer needed.
The default prompt references the trigger phrase "$zhizhi-math-worksheet" but does not clarify when the skill should or should not be invoked beyond a general description. It also provides no negative examples or scope constraints, which makes the activation boundary ambiguous in a manifest file.
The file explicitly instructs the system to save the input list, generated content, and answer manifest, which can include student work and potentially personal or educational data. Because there is no accompanying retention limit, minimization rule, consent notice, or privacy control, this creates a real privacy and data-governance risk if the skill stores sensitive learner information longer than necessary or without user awareness.
No suspicious patterns detected.
