Language Tutor Pro
v1.0.3Duolingo taught you how to say 'the cat drinks milk' for the 500th time. You still can't order dinner in Spanish. Language Tutor Pro skips the gamification a...
⭐ 0· 89·0 current·0 all-time
by@nollio
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name/description (a persistent language tutor) matches what the files do: storing learner profiles, vocab, grammar, sessions, and driving conversational lessons. One minor mismatch: the package metadata lists no required binaries, but the scripts call python3 (and are shell scripts), so the skill implicitly requires Python 3 and a POSIX shell to function.
Instruction Scope
SKILL.md and the examples instruct the agent to read and update local files in the skill's data/ directory and run post-session bookkeeping. The instructions do not direct the agent to read unrelated system files or external endpoints. The README/SECURITY notes clearly warn that conversation text will be sent to whatever LLM backend the OpenClaw agent is configured to use.
Install Mechanism
There is no external install step or downloaded code; the skill is instruction + local scripts that the user places into their agent skills folder. No network downloads, no remote executables or obfuscated payloads are present in the included files.
Credentials
The skill declares no required environment variables or credentials and indeed the code does not attempt to read secrets. The only proportionality issue is that scripts require python3 (and assume bash) but the metadata did not declare this; otherwise there are no requests for unrelated credentials or system-wide config access.
Persistence & Privilege
The skill stores persistent learner data under its own data/ directory and includes scripts to create and export that data. It does not request always:true and does not modify other skills or global agent config. The dashboard manifest expects a refresh command that may be invoked by a dashboard (which is expected behavior for local skill dashboards).
Assessment
This skill appears to do what it says: it keeps local files with your profile, vocabulary, grammar tracking, session logs and transcripts and provides scripts to initialize and export that data. Before installing: (1) review and approve the scripts (they run locally and require bash + python3 — the skill forgot to declare python3 as a required binary); (2) be aware that conversation content will be transmitted to whatever LLM backend your OpenClaw agent is configured to use (so choose a private/local model or review your LLM provider's data policies if privacy is a concern); (3) protect the skill's data/ folder if it will contain any personal details; and (4) if you enable the dashboard, note the dashboard may run the export script (dashboard-kit/manifest.json -> refresh_command). If you want stronger guarantees, run the agent with a local LLM or inspect/modify the scripts to sanitize or encrypt transcripts before writing them to disk.Like a lobster shell, security has layers — review code before you run it.
latestvk97edbj5fw3aynsgntq680e2zs83z310
License
MIT-0
Free to use, modify, and redistribute. No attribution required.