Tutor Buddy Pro

Provides step-by-step, interactive homework help using the Socratic method, tracks progress, creates study plans, and adapts to each student's learning style.

This package appears coherent with its stated purpose (local tutoring, Socratic flows, and local progress tracking). Before installing: 1) Only paste the provided system prompt into your agent if you trust the skill source — that is a privileged change. 2) Be aware generate-progress-report.sh requires python3 and Playwright (which may download Chromium during installation); install those tools consciously and review their network behavior if you need to keep everything offline. 3) The dashboard docs describe optional remote sync/dashboard components — those are separate and would require you to deploy or connect to a web service; nothing in this package automatically exfiltrates data. 4) The SKILL.md contains explicit prompt-injection defense (which is why the scanner flagged patterns); review that section to confirm it matches your safety expectations. If you want higher assurance, run the skill in a sandboxed agent instance and inspect network activity while exercising the report-generation path.

Type: OpenClaw Skill Name: normieclaw-tutor-buddy-pro Version: 1.0.3 The skill provides an AI tutoring platform with a report generation feature. The script `scripts/generate-progress-report.sh` is classified as suspicious because it introduces high-risk capabilities, specifically the use of a headless browser (Playwright) and shell execution to render HTML reports. The script also contains vulnerabilities, such as the potential for arbitrary file writes via an unvalidated output path argument and a lack of HTML escaping for user-provided data (e.g., student names) in the generated report, which could lead to local code execution within the browser environment. While these features are aligned with the stated purpose of visual progress tracking, the implementation provides a significant attack surface without sufficient sanitization.