Security audit
Security checks for vulnerabilities and agentic risk
This is a Chinese K12 biology chart tutoring skill with disclosed, consent-gated profile, handover, and reminder behavior.
Install this for Chinese-language biology tutoring contexts where learning profile memory and reminders are acceptable. Before using it with minors or outside mainland China, confirm guardian/consent handling and localize emergency/help-channel guidance.
The schema's user-facing natural-language fields such as the scope note and top-level description are written only in Chinese, with no indication that users can choose another language or that the file is restricted to a Chinese-only deployment. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.
The file’s user-facing natural-language content is entirely in Chinese and does not indicate any language choice, fallback, or opt-in. Under the stated policy, forcing a specific language without offering the user a language/locale choice is a natural-language policy violation.
The title hard-codes the protocol as "XiaozhiMultiAgentHandoverProtocol," and the surrounding natural-language descriptions are entirely in Chinese, indicating a fixed language presentation rather than offering a user choice. For a shared protocol schema distributed across skills, this can violate language/locale policy when no opt-in or justification for the fixed locale is provided in the file.
The schema explicitly distributes cross-skill handover capabilities to this chart-reading skill, allowing transfer of wrong-answer records and reminder requests to other skills. Even though the file is only a schema, granting these flows broadens the skill’s data-sharing scope beyond its narrowly described chart-interpretation role and increases the chance of unnecessary collection or propagation of student data.
The reminder payload supports scheduling, priorities, due dates, and merge behavior, which enables this skill to initiate reminder workflows unrelated to merely explaining biology charts. In an education setting involving minors, this expands the operational scope from tutoring into behavioral prompting and creates additional privacy and consent risk if reminders are generated too broadly or with over-collected content.
L11 明确声明“本库按中国大陆的中文 K12 场景设计”，将语言、课程口径和默认求助渠道绑定到特定地区与语言。虽然后文说明部署到其他地区需先做本地化，但这里没有提供面向用户的语言/地区选择或显式 opt-in，符合语言/locale policy violation 的判定条件。
No suspicious patterns detected.
