AI-Integrated STEAM Lesson Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:00 AM UTC
• Version: 1.0.0

Overview

The skill is a lesson-plan generator, but it repeatedly tells teachers to use outside AI services with student work and classroom accounts without enough privacy, consent, or school-control safeguards.

Before installing or using this skill, require school-approved AI platforms and accounts, remove or anonymize student identifiers before any AI use, avoid uploading student images or portraits unless consent and policy approvals are in place, do not share credentials, and do not bypass blocked services with personal hotspots.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:170

Finding

Student Work Is Submitted to Third-Party AI Services Without Privacy Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:170-210; examples/P4_Science_Plant_Life_Cycle.md:169-205; examples/S2_English_Descriptive_Writing.md:289-326; examples/S2_VisualArts_Digital_Portrait.md:239-287
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Relevant snippet from SKILL.md:

text

### 5B. AI-Assisted Assessment (NEW)

Use GLM5 or other AI tools to help evaluate student work:

How to Use AI for Assessment:

1. Take a photo/screenshot of student work
2. Upload to GLM5 (or paste text description)
3. Use this prompt:
...
Student work: [Describe or paste content]
...
Important:
- AI assists, not replaces, teacher judgment
- Always review AI suggestions before giving to students
- Use AI for initial feedback, not final grades

Relevant snippet from examples/S2_English_Descriptive_Writing.md:

text

How to Use GLM5 to Help Evaluate Student Paragraphs:

1. Copy the student's paragraph
2. Open GLM5 (chat.openai.com or school platform)
3. Use this prompt:
...
Student paragraph:
[paste paragraph]

Relevant snippet from examples/S2_VisualArts_Digital_Portrait.md:

text

How to Use GLM5 to Help Evaluate Student Portraits:

1. Take a screenshot of the student's digital portrait
2. Open GLM5 (chat.openai.com or your school's AI platform)
3. Use this prompt:

Technical Analysis

The Skill handles work produced by Primary and Secondary students and instructs teachers to copy, photograph, or upload that work to external AI services. It does not require removal of student names, faces, school identifiers, document metadata, or other personal information before transmission.

The workflow also lacks controls concerning guardian or student consent, school authorization, data retention, provider training-data policies, geographic processing location, access control, and minimum-necessary disclosure. The inst ...[truncated 1166 chars]

Remediation

View remediation

Remediation Suggestions

• Require institution-approved AI services and school-managed accounts.
• Prohibit uploading identifiable student work unless expressly authorized by the school and supported by applicable student or guardian consent.
• Require removal of names, faces, school details, account identifiers, comments, revision histories, and embedded metadata.
• Submit only the minimum excerpt or abstract description needed for assessment.
• Add provider-review requirements covering retention, model training, subprocessors, access controls, deletion, and data location.
• Prefer locally hosted or contractually approved educational platforms for assessment.
• Add a mandatory teacher verification step and document that external AI output must not determine final grades.
• Provide an offline assessment workflow when privacy requirements cannot be satisfied.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: examples/S2_VisualArts_Digital_Portrait.md:314

Finding

School Network Restrictions Can Be Bypassed Through Personal Hotspots

Content

View full analysis

Vulnerability Details

File Location: examples/S2_VisualArts_Digital_Portrait.md:314-316
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Complete vulnerable snippet:

text

Common Issues & Solutions:
- Canva AI blocked on school network: Use personal hotspots or prepare offline examples
- Students copy AI output entirely: Require clear annotation of "AI parts" vs "my parts"

Technical Analysis

The recommendation to use a personal hotspot treats circumvention of institutional filtering as a troubleshooting measure. School network blocks may enforce safeguarding, legal, licensing, malware filtering, data-loss prevention, or service-approval policies. Moving devices to an unmanaged personal connection bypasses those controls rather than resolving the underlying authorization issue.

Although the instruction does not elevate operating-system privileges, it crosses an institutional access-control boundary and can allow access to a service that administrators intentionally blocked. The alternative recommendation to use offline examples is safe and should be retained as the only fallback unless IT explicitly authorizes another network.

Attack Path

1. School administrators block Canva AI or a related service on the managed network.
2. A teacher or student follows the lesson’s troubleshooting instructions.
3. The device is connected to a personal hotspot.
4. Institutional filtering, monitoring, and data-loss prevention controls no longer govern the connection.
5. Students access the blocked service and may transmit school or student data through an unmanaged network.

Impact Assessment

The bypass can expose classroom devices and student data to unapproved external services. It may defeat school monitoring and safeguarding controls for all participating devices. It does not directly provide administrator privileges, but it enables unauthorized net ...[truncated 57 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the personal-hotspot recommendation.
• State that blocked services must not be accessed without approval from school IT or safeguarding personnel.
• Use institution-approved alternatives or teacher-prepared offline examples.
• Require testing through managed school devices and networks before the lesson.
• Document an escalation process through IT for reviewing and authorizing required services.
• Prohibit transmission of school or student data over unmanaged networks unless expressly authorized by institutional policy.

T09 · Insecure Skill Coding Practices

Warning

• Location: examples/S2_English_Descriptive_Writing.md:7

Finding

Shared Student Accounts Undermine Authentication and Accountability

Content

View full analysis

Vulnerability Details

File Location: examples/S2_English_Descriptive_Writing.md:7-15
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Complete vulnerable snippet:

text

□ GLM5 - Quick Setup (3 min)
  - Step 1: Go to https://chat.openapi.com or your school's AI platform
  - Step 2: Create free account if needed
  - Step 3: Test prompt: "Brainstorm 10 descriptive adjectives for a dark forest"
  - Link: https://chat.openai.com (or school GLM5 access)
  - Note: Students will use in pairs — can share accounts

Technical Analysis

Recommending shared accounts weakens authentication boundaries and prevents reliable attribution of actions. Students using the same credentials or active session may see each other’s prompt history, uploaded files, generated content, profile information, and account settings.

Shared credentials also complicate revocation, incident response, audit logging, and compliance with provider terms. Pair work does not require credential sharing; students can collaborate while one authorized account holder controls an institution-managed session.

Attack Path

1. Students create or receive a shared service account.
2. Credentials or an authenticated browser session are used by multiple students.
3. One student accesses prompts, files, history, or settings created by another student.
4. Shared credentials may be copied, retained, or reused outside the supervised lesson.
5. Unauthorized access cannot be attributed reliably because all activity appears under one identity.

Impact Assessment

The issue can expose student work, prompt histories, and account information to other students. It may allow modification or deletion of shared content and unauthorized continued use of the account. The affected scope includes all users and data associated with each shared account, but it does not directly compromise the local operating system.

Remediation

View remediation

Remediation Suggestions

• Explicitly prohibit credential sharing.
• Use institution-managed individual student accounts where student access is necessary.
• Prefer provider-supported classroom, team, or supervised group features.
• For pair activities, have one authorized user operate the session without disclosing credentials.
• Use teacher demonstrations or pre-generated outputs when managed student accounts are unavailable.
• Require logout after shared-device use and configure browser sessions not to retain credentials.
• Establish account revocation, access review, and audit procedures.

T08 · Insecure Dependencies

Warning

• Location: examples/S2_English_Descriptive_Writing.md:7

Finding

Mismatched AI Service Domains Can Misdirect Users

Content

View full analysis

Vulnerability Details

File Location: examples/S2_English_Descriptive_Writing.md:7-15
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete vulnerable snippet:

text

□ GLM5 - Quick Setup (3 min)
  - Step 1: Go to https://chat.openapi.com or your school's AI platform
  - Step 2: Create free account if needed
  - Step 3: Test prompt: "Brainstorm 10 descriptive adjectives for a dark forest"
  - Link: https://chat.openai.com (or school GLM5 access)
  - Note: Students will use in pairs — can share accounts

Technical Analysis

The setup step names https://chat.openapi.com, while the link later names https://chat.openai.com. These are distinct domains. The same section also refers to the tool as GLM5, creating additional uncertainty about which provider is intended.

Because users are instructed to create an account if necessary, domain ambiguity can cause teachers or students to submit registration information or credentials to an unintended external service. This is a third-party service integrity issue analogous to relying on an incorrectly named or unverified external dependency.

Attack Path

1. A teacher or student follows the first setup URL rather than the later link.
2. The user assumes the different domain is the intended AI provider.
3. The user creates an account, enters credentials, or submits classroom content.
4. Information is disclosed to a service different from the one expected or approved by the school.
5. Reused credentials could increase the impact if the unintended service mishandles or compromises them.

Impact Assessment

The issue may expose registration details, credentials, prompts, and student work to an unintended external domain. It does not execute local code or automatically transmit secrets, so exploitation depends on a user following the incorrect instruction. The potential scope includes every teacher or student who uses tha ...[truncated 13 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the incorrect or unintended URL with the verified official HTTPS endpoint.
• Ensure the displayed tool name, provider name, and destination domain are consistent.
• Prefer school-approved platform links supplied by administrators.
• Add a warning not to enter credentials after arriving through an unverified or redirected domain.
• Validate every external link before release and include link checking in publication review.
• Advise users to use unique institution-managed credentials and approved single sign-on rather than reused personal passwords.

T09 · Insecure Skill Coding Practices

Warning

• Location: examples/S2_VisualArts_Digital_Portrait.md:347

Finding

Class Portraits Are Published Without Consent or Access-Control Requirements

Content

View full analysis

Vulnerability Details

File Location: examples/S2_VisualArts_Digital_Portrait.md:347-353
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Complete vulnerable snippet:

text

Extension 3: Virtual Gallery
- Use Gamma to create a virtual art gallery
- Upload all class portraits
- Share link with parents/school community

Technical Analysis

The workflow directs teachers to upload all class portraits and distribute a gallery link without requiring consent, anonymization, moderation, metadata removal, expiration, or authenticated access. Portraits may depict actual students or contain names, likenesses, school information, comments, or embedded metadata.

Sharing with the school community does not ensure that access remains limited to that audience. A public or unrestricted link can be forwarded, indexed, copied, or retained by unintended recipients.

Attack Path

1. Students create portrait files that may contain identifiable content or metadata.
2. The teacher uploads all class portraits to Gamma.
3. The teacher creates and distributes a gallery link.
4. The link is configured without adequate authentication or is forwarded beyond the intended audience.
5. Unauthorized viewers access, download, redistribute, or associate the work with individual minors.

Impact Assessment

The exposure may affect an entire class and can disclose minors’ likenesses, creative work, names, school affiliation, or metadata. Unauthorized recipients may retain or redistribute the content after the gallery is removed. No local system privileges are obtained; the primary impact is loss of confidentiality, consent, and control over student content.

Remediation

View remediation

Remediation Suggestions

• Require documented school authorization and applicable student or guardian consent before publication.
• Provide an opt-out path that does not disadvantage students.
• Remove names, faces where unnecessary, school identifiers, comments, and embedded metadata.
• Review every item before upload and prohibit bulk publication without moderation.
• Configure galleries as private, authenticated, non-indexed, and read-only.
• Apply expiration dates and delete gallery content after the educational purpose ends.
• Prohibit public links and uncontrolled resharing.
• Use an institution-controlled learning platform instead of a public third-party gallery where possible.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (13)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The assessment workflow directs teachers to submit screenshots or descriptions of student work to an external AI service without any privacy warning or minimization guidance. Because the content concerns primary students, screenshots may contain names, identifiers, faces, account details, or other educational records, creating a significant student-data exposure risk when sent to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The assessment section recommends taking screenshots of student work and uploading them to GLM5/chat platforms for evaluation, but it omits warnings about student data exposure, retention, model training, or cross-border transfer. If screenshots, names, or identifiable artistic content are submitted, minors' work and assessment context may be disclosed to external AI providers without proper authorization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README promotes AI-assisted grading and student use of multiple third-party AI tools but provides no warning about privacy, consent, or student-data handling. In a school context, teachers may upload student work, names, images, or performance data to external services, creating a realistic risk of FERPA/GDPR/local policy violations, unauthorized data sharing, or exposure of minors' information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs teachers to upload photos, screenshots, or pasted descriptions of student work to an external AI service without any prior privacy, consent, data minimization, or retention guidance. In a school context, student work can contain personally identifiable information or sensitive educational records, so this creates a real risk of unauthorized disclosure to third-party processors and potential noncompliance with school or jurisdictional privacy requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The lesson instructs teachers to prepare student Canva accounts and have students use third-party AI tooling, but it provides no warning about student privacy, parental consent, age restrictions, data retention, or what information may be uploaded or generated. In a primary-school context, this increases the risk of exposing minors' personal data, account identifiers, and student-created content to external services without appropriate safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The lesson instructs students to paste their writing into an external AI service for feedback without any privacy notice, consent guidance, or de-identification step. Even if the content is only a paragraph, student work can still constitute educational data and may be retained, logged, or used by the third-party platform depending on deployment and settings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The teacher assessment workflow explicitly directs staff to copy student paragraphs into GLM5/chat.openai.com for evaluation, but provides no warning about external data sharing, retention, or compliance with student privacy obligations. Because this is framed as a grading workflow, it increases the chance of routine bulk transfer of student submissions to a third party without review of policy, consent, or anonymization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The lesson directs students to create Canva accounts and use third-party AI services without any guidance on parental consent, school policy, age requirements, data minimization, or what personal data may be shared with vendors. In a school setting involving minors, this can expose student identities, usage data, prompts, and creative work to external platforms in ways teachers may not realize.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The virtual gallery activity suggests sharing student portraits with parents and the school community without mentioning consent, opt-out, attribution controls, or whether portraits contain identifying features. Even if the images are stylized, publishing student-created portraits can expose minors' work, likeness, names, or class participation beyond the classroom.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The README presents AI-generated lesson plans and assessment assistance as ready-to-use without clearly requiring teacher verification. This can lead users to rely on inaccurate, biased, or pedagogically unsuitable outputs in lesson delivery or grading, especially when AI-assisted assessment is positioned as a time-saving feature.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The note says to default to bilingual (Chinese/English) for the Hong Kong context, which imposes a language choice unless the user explicitly selects otherwise. The policy requires offering language or locale choice rather than forcing or defaulting to a specific language setting without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file directs teachers to record in Chinese with English subtitles and repeats this as a teacher tip later, rather than presenting language selection as optional. Because SQP-3 applies to language or locale policy violations, this fixed language requirement may conflict with environments where language choice should be user- or school-determined.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This section again instructs teachers to use a specific language format for the avatar video without opt-in or alternatives. That is a natural-language locale constraint and may violate organizational expectations for user language choice unless clearly scoped or justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.