AI 伴学助手

• Outcome: Review
• Latest audit: Jul 29, 2026 · 10:37 AM UTC
• Version: 1.0.1

Overview

This skill is a coherent homework helper, but it needs Review because it processes children's images, audio, text, and learning records through cloud services and persistent local reports without clear consent, retention, or sharing controls.

Install only if a parent or authorized adult is comfortable with children's homework images, voices, text, and learning summaries being sent to Tencent Cloud and stored locally. Use minimized inputs, avoid names/schools/identifiers, restrict access to generated Excel and report files, and review any enterprise-message or Tencent Docs sharing before enabling it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The invocation examples are broad enough that the skill may activate on loosely related phrases like homework help or study assistance without clearly signaling when cloud OCR/ASR/TTS processing and reporting features will be used. In a child-focused context, over-broad activation increases the chance of unintended handling of minors' images, audio, and educational records, creating privacy and consent risks rather than direct code-execution risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README promotes uploading homework photos, screenshots, and spoken content and generating parent reports through Tencent cloud-backed services, but it does not warn users that children's data may be transmitted to third-party cloud APIs. Because the skill is explicitly aimed at K12 children, this omission materially increases privacy, consent, and regulatory risk around minors' personal data.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill instructs sending children's homework images, screenshots, and audio to Tencent Cloud OCR/ASR/TTS services, but it does not present a clear upfront warning or consent step about third-party transmission and processing. Because the content may include minors' voice, handwriting, schoolwork, and other personal data, silent transmission creates meaningful privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The template explicitly suggests saving reports locally and pushing them through enterprise messaging or Tencent Docs, but it does not require privacy safeguards, consent, minimization, or access controls for student data. Because this skill handles K12 homework records and learning profiles, the omission can lead to inappropriate disclosure of sensitive child educational information to unintended recipients or insecure storage locations.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The document explicitly instructs generating and appending to a persistent local Excel file, and later states the file should accumulate across sessions. In this K12 tutoring context that behavior is expected, but without a clear upfront notice/consent step it can surprise users by modifying local state and retaining children's learning data over time.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script sends full audio content to Tencent Cloud ASR, which is a third-party network service, but the code path provides no user-facing notice, consent check, or data-handling disclosure at the point of transmission. In a K12 homework context, this may include children's voices and other sensitive personal data, increasing privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script base64-encodes the provided homework image and sends it to Tencent Cloud OCR, but the user-facing CLI and comments do not explicitly warn that image contents leave the local environment. In a K12 homework context, submitted images may contain children's personal data, school information, or other sensitive content, so undisclosed third-party transfer creates a real privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script transmits arbitrary input text to Tencent Cloud TTS, which can include children's homework content, parent notes, or other sensitive educational data, but it gives no explicit user-facing notice at the point of use that the text leaves the local environment. In this skill context, that matters because the assistant is aimed at K12 users, so silent cloud transmission raises privacy and consent risks even if the behavior is functionally expected.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill directs persistence and cross-session aggregation of a child's wrong answers, reports, subjects, weaknesses, and study history without defining retention limits, access controls, minimization, or parental consent. For a K12 context, this creates substantial privacy risk because sensitive educational profiles can accumulate over time and be leaked, over-retained, or shared beyond the original tutoring purpose.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

tencentcloud-sdk-python>=3.0.0

• Confidence: 92% confidence
• Finding: The dependency is specified with a lower-bound range only, which allows installation of any future version of the Tencent Cloud SDK. That can introduce supply-chain risk through unexpected breaking changes or a compromised upstream release, especially because this skill depends on cloud APIs and handles potentially sensitive student homework data and credentials.

Static analysis

No suspicious patterns detected.