Security audit
Security checks for vulnerabilities and agentic risk
This is a classroom PPT helper with no executable code or hidden privileges, though its language defaults and one reference link are rough edges.
Before installing, treat this as a narrow helper for Chinese junior-high class meeting and English lesson PPT creation. Review the generated lesson content for accuracy, age appropriateness, and preferred classroom language, and be aware that one reference link in the skill appears mistyped.
The trigger conditions are broad enough that the skill may activate on vague mentions of '班会' or '英语课' together with PPT, even when the user did not clearly request this specific workflow. Overbroad activation can cause incorrect tool routing, unintended retrieval/generation behavior, and increased exposure to prompt-scope confusion if competing skills or user intents are present.
The skill hard-codes output language by lesson type ('全中文' for class meetings and '中英混合' for English lessons) without checking the user's stated language preference. This can override user intent, produce inappropriate outputs for the audience, and create reliability and usability issues, though it is not a direct code-execution or data-exfiltration risk.
The markdown content is entirely written as a Chinese-only framework and examples, with no indication that users may choose another language or that the skill is limited to a Chinese-language or region-specific context. This creates a natural-language locale constraint that can conflict with organizational language-choice policies.
This markdown file contains a topic title in English ('The Power of Yet') within an otherwise Chinese-language document, with no indication that users can choose their preferred language or locale. The stated policy category covers language or locale constraints in natural-language content, and this mixed-language presentation may be inconsistent with a user's expected language setting.
Line L44 states '语言：英语为主，中文仅解释难点', which imposes a language policy rather than offering a user-selectable preference. Under the stated policy criteria, forcing a specific language without opt-in is a natural-language policy violation.
No suspicious patterns detected.
