Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Chinese K12 math-coaching skill with bounded, consent-gated use of student learning records rather than hidden or destructive behavior.
Install this only for the intended Chinese K12 math-tutoring setting and make sure the host platform enforces the consent fields, guardian rules, cross-skill sharing limits, and localized crisis-contact guidance before enabling student records or reminders.
In the markdown trigger section, phrases like “我不知道怎么做” and “帮我看看这道题” are common everyday requests and are not specific to math by themselves. Although nearby text mentions math problems, the trigger list does not provide negative examples or tighter scope constraints, which raises the risk of unintended activation.
The entire file instructs the agent to interact with students using fixed Chinese prompts and does not provide any user opt-in or alternative language handling. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is explicitly justified.
The manifest says this coach should not handle '错因子类型与顽固弱项分析' and should transfer that work to xiaozhi-math-error-dna, and also not do long-term mistake recording/statistics. Here the document instructs the skill to collect three similar wrong problems, compare them horizontally, and summarize a shared root cause in-session. Even though it says it does not write archives, this still exceeds the stated coaching-only scope by performing cross-problem causal analysis.
Suspicious Unicode normalization or mixed-script content
Suspicious Unicode normalization or mixed-script content
This reference file is entirely written in Chinese and is framed as direct skill resource content for xiaozhi-math-problem-solving-coach, with no indication that users can opt into another language or locale. Under the policy rule, forcing a specific language without user choice is a natural-language policy concern unless the locale constraint is explicitly documented and justified.
Suspicious Unicode normalization or mixed-script content
This markdown resource presents all instructions and content exclusively in Chinese, and there is no indication that the user can choose another language or that the locale restriction is intentional. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
The document first states that the five-question chain and the four-step method are mutually exclusive on the same problem, but later allows the five-question chain after the four-step method on that problem. This contradiction can bypass intended workflow safeguards, leading the agent to over-engage, exceed bounded interaction patterns, and ignore designed stopping conditions.
L007 将触发条件写为“学生已经做出来了、说‘我懂了’”，其中“我懂了”是非常常见的日常表达，单独作为触发信号容易与普通对话重叠。虽然 L008 补充了未做出来的排除条件，但仍缺少更明确的边界或负例来说明哪些情形不应进入五问链。
The manifest says elementary use is only a downgrade reference and should not expand service scope to primary school. This file nevertheless provides a detailed standalone小学高段 adaptation section with full scripts, follow-up logic, and operating rules, which operationalizes primary-school support rather than merely noting a boundary.
The guide instructs handoff/recording into other skills and notebooks, which conflicts with the declared default behavior of not archiving, not reading files, and not recording unless the student explicitly enables it in the current turn. If followed automatically, this could cause unintended persistence or cross-skill data transfer of student learning data without valid consent.
L383-L384 写明学生说“我懂了”时“立即启动第1问”，再次把通用口语表达直接绑定为触发条件。该表述没有提供额外上下文约束、限定场景或排除条件，容易在普通确认理解的交流中误触发此技能分支。
This file contains numerous mandated user-facing utterances in Chinese, such as the required prompts in S0_OCR_FAIL, S1, and S6, but nowhere indicates that the skill is Chinese-only, region-specific, or that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The document claims the skill must not write math error DNA, but the workflow still records structured error dimensions and subtype codes aligned to a taxonomy. That contradiction is dangerous because implementation teams or orchestration layers may treat these fields as normalized diagnostic data and store, analyze, or reuse them as de facto error-DNA despite the prose restriction.
The skill manifest says it should not handle long-term error-cause typing or weak-point analysis, yet the state schema still captures structured fields like basicDimension, subtypeId, intentBranch, hintLevel, and rootCause. Even if described as session-only, this creates a ready-made taxonomy for profiling student weaknesses and increases the chance of policy drift, accidental retention, or downstream handoff beyond the stated scope.
The file is entirely written in Chinese and provides operational guidance for skills without any indication that users may select another language or locale. Under the natural-language policy rule, forcing a specific language without user opt-in is a policy concern unless the locale restriction is explicitly documented and justified.
The schema title, note, and description are written entirely in Chinese, establishing a language-specific interaction/documentation expectation. Under the stated policy, forcing a specific language without offering a choice or documenting a justified locale constraint is a natural-language policy violation.
The entire shared instruction file is written as mandatory Chinese guidance and does not indicate that users or downstream skills may choose another language. This creates a natural-language locale policy concern because it effectively fixes the operating language without documenting opt-in, alternatives, or a region-specific justification.
The document states the library is designed for '中国大陆的中文 K12 场景' and requires operators to localize before use elsewhere. This is a natural-language locale constraint that applies a specific language/region by default and does not offer user opt-in or runtime choice within the skill guidance.
The document establishes a repository-wide single source of truth for terminology and all defined terms and instructions are presented only in Chinese. Because this applies across the whole skill library and does not offer user opt-in or explain a region-specific necessity, it constitutes a locale/language policy concern under the natural-language policy rule.
The description says the skill is also used for review requests like “明天数学考试，帮我梳理这一章” and notes it should enter immediately only when the student explicitly mentions an imminent exam. However, it does not clearly delimit non-triggering adjacent cases in the same summary text, which can make activation boundaries harder to infer from the manifest alone.
The manifest scope is '初中到高中的数学单题解题教练'. This file adds a dedicated '小学高年级（5-6年级）适配' section with concrete operating guidance, which expands intended use beyond the declared grade range. Even if framed as a downgrade scenario, it is still behavior guidance outside the manifest's stated target population.
No suspicious patterns detected.
