Security audit
Security checks for vulnerabilities and agentic risk
This TOEFL speaking practice skill is a simple Markdown-based study helper that generates questions and stores local practice history, with no executable code or network behavior found.
Install this if you want a Chinese-language TOEFL speaking practice workflow that keeps local records. Be aware that generating or changing a question set will update files under toefl/ and may retain generated answers and practice history.
The natural-language instructions and user interaction phrases are entirely in Chinese, and the skill does not indicate that language choice is optional or limited for a justified regional reason. This can violate language/locale policy when a skill effectively requires a specific language without user opt-in.
The trigger phrases include very broad everyday expressions such as “出题” and “换一个/换个话题”, which can be invoked accidentally in normal conversation and cause the skill to perform stateful actions. Because this skill reads and writes local files and changes persistent history, ambiguous activation increases the chance of unintended file modification and disclosure of stored answer content.
The skill explicitly performs persistent writes to latest.md, history.json, and dated archive files, but the user-facing interaction description does not warn that invoking the skill modifies stored data. This creates a risk of silent state changes, accidental overwrites, and retention of potentially sensitive user-study artifacts without informed consent.
The role and instructions are written in Chinese and implicitly require the skill to operate in Chinese, but the file does not offer any user opt-in or alternative language choice. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is clearly justified.
No suspicious patterns detected.
