Security audit
Security checks for vulnerabilities and agentic risk
This is a teacher-facing English speaking lesson-design skill with disclosed data controls and no executable or hidden behavior, though users should handle student recordings and records under school privacy rules.
Install only for Chinese K12 teacher workflows. Before using student voice samples or writing records back to student profiles, confirm school policy, guardian/student consent where required, minimize stored data, and use the provided pause/delete/sharing controls when records should not be retained or shared.
The trigger section lists phrases such as “口语课怎么上”, “对话练习怎么设计”, and “学员口语弱”, which are generic enough to overlap with ordinary teaching discussion and could cause unintended activation. The section provides example phrases but does not define constraints, exclusions, or negative examples clarifying when this skill should not trigger versus related teaching/planning skills.
The file instructs teachers to prepare and retain 'student voice recording samples' but provides no guidance on consent, retention, access control, minimization, or local policy compliance. Because voice recordings of minors are personal data and potentially biometric data, this omission can lead to unauthorized collection, over-retention, or improper sharing.
This file contains instructional content that is fixed to a specific locale/language context: all guidance is presented in Chinese and assumes that format without offering an alternative or documenting that the skill is intentionally region-specific. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.
This markdown file presents all instructions and rubric content in Chinese from the title onward, which effectively forces a specific language for users. Under the policy, locale or language constraints should either be optional for the user or clearly justified as region-specific; this file does not provide that justification or opt-in.
This markdown file presents all instructional content in Chinese only, which can constitute a language/locale policy issue when no user choice or opt-in is provided. The file does not indicate that the Chinese-only format is optional, selectable, or justified as a region-specific constraint.
The description states '词表以 shared/vocab.md 为准' and the schema uses Chinese-only field descriptions and enumerated values throughout, which imposes a Chinese-language locale on consuming skills. The file does not offer any language choice or explain a justified region-specific constraint, so this is a natural-language locale policy concern.
The entire skill reference content is written in Chinese and presents operational guidance only in that language, with no indication that users can choose another language or locale. This is a natural-language locale constraint that could conflict with organizational policies requiring language choice or explicit opt-in.
The entire shared instruction file is written as mandatory operational guidance in Chinese and includes no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly justified.
Lines L181-L183 prescribe unified names and labels exclusively in Chinese, such as fixed coordinator names, assessment types, and copyright-status values. This is a natural-language locale policy constraint, and the file does not indicate user opt-in or clearly justify that the skill is intentionally limited to a Chinese-only regional context.
L11 明确说明本库按“中国大陆的中文 K12 场景”设计，且 L13-L17 要求其他语言或地区在完成本地化前“不应直接面向学生使用”。这属于自然语言中的语言/区域限制策略；虽然文中给出了适用性说明和本地化要求，但当前表述仍是对默认语言/地区的强约束。
No suspicious patterns detected.
