Security audit
Security checks for vulnerabilities and agentic risk
This is a simple study-question skill with no code execution, external access, credential handling, or persistence beyond conversational progress tracking.
Installers should be aware that generic requests like "give me a question" may route to this skill; use a more specific invocation if multiple education skills are installed. No sensitive access or high-impact authority was found.
The description limits the skill to Chinese, Math, and English and presents bilingual branding, but does not state whether the interaction language is user-selectable or why a fixed locale/language scope is required. Under the policy, language or locale constraints should be optional for the user or clearly justified.
The trigger phrases "daily question" and especially "give me a question" are broad and likely to match ordinary conversation outside the intended educational workflow. This can cause unintended skill activation, hijacking user intent or suppressing other more appropriate skills, which is a genuine routing and UX security concern even though the skill content itself is low risk.
No suspicious patterns detected.
