Security audit
Security checks for vulnerabilities and agentic risk
This documentation-only skill is coherent for an adaptive testing API, but users should handle real student records and destructive API actions carefully.
Install only if you are authorized to use the AdaptiveTest API with the relevant student and assessment data. Treat the API key as sensitive, avoid sending real student identifiers unless privacy requirements are satisfied, and require explicit user confirmation before creating, changing, enrolling, calibrating from, or deleting records.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
DELETE /tests/{test_id}
The README advertises handling of student records, assessment history, analytics, and personalized recommendations, all of which can involve sensitive education data, yet it provides no warning that this data is sent to an external API or guidance on privacy/compliance obligations. In a skill ecosystem, users may invoke these features with real student data, creating a risk of unintended disclosure, non-compliant processing, or unsafe sharing of educational records.
The skill explicitly supports student management, assessment history, and personalized learning recommendations while directing data to an external API service, but it does not warn users that potentially sensitive student data will be transmitted off-platform. In an education context, this is significant because student identifiers, performance history, and recommendation inputs may constitute protected educational or personal data, increasing privacy and compliance risk.
This markdown file describes starting adaptive sessions and transmitting student_id, and elsewhere exposes student records, emails, histories, and results, but it does not include any warning that these operations involve student data and assessment records. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or privacy.
The manifest description summarizes the skill as an adaptive testing engine with IRT/CAT, AI question generation, and personalized learning recommendations. In contrast, the README documents additional operational scope including student/class management CRUD and analytics, which expands the behavior beyond the manifest summary.
The documentation says 'This is a skill distribution repo. It contains no application code,' but elsewhere describes the skill as enabling assistants to interact with the AdaptiveTest platform API and lists concrete supported capabilities. This is an intent/documentation contradiction about whether the repository is purely metadata or represents executable skill behavior.
The API reference includes a DELETE /tests/{test_id} endpoint but provides no warning that the operation may remove test content or affect associated data. In markdown documentation, destructive behaviors should be accompanied by a warning when they may affect user data or system integrity.
No suspicious patterns detected.