AI Tutor

AI智能家教老师。专为小学生、初中生、高中生提供全学科辅导。 特点：(1) 个性化教育，根据学生反馈调整 (2) 深入浅出讲解，支持追问 (3) 互动式教学，主动提问 (4) 课程连贯性，学习记录延续 (5) 支持语音+图形讲解 触发条件：(1) 学生问作业题 (2) 辅导功课 (3) 知识点讲解 (4) 学习规划

This skill appears to do what it says: tutoring with local student profiles. Before installing, consider the following: (1) The Python script writes JSON files to a hard-coded path (/Users/josephauto/...). That path is unusual and not configurable — change DATA_DIR to a safe, per-agent or per-user location (or make it configurable via an environment variable) before use. (2) The skill will persist student data locally; review what information you will store and ensure appropriate file permissions and data retention policies (especially for minors). (3) The prompts mention using a TTS tool and a drawing tool but don’t specify which services — verify which local or external tools the agent will call and whether those tools require network access or credentials. (4) The script’s mkdir lacks parents=True; on systems without that exact path it may fail — adjust to create a configurable directory safely. If you cannot or will not modify the code, run the skill in a sandboxed environment and inspect the DATA_DIR and outputs before using with real student data.

Type: OpenClaw Skill Name: tutor-ai Version: 1.0.0 The skill contains a path traversal vulnerability in `scripts/student_manager.py` because the `student_id` parameter is used to construct file paths without sanitization, which could allow reading or writing files outside the intended directory. Additionally, the script hardcodes an absolute path tied to a specific local user (`/Users/josephauto/`), which is a security anti-pattern and indicates poor portability or potential environment-specific targeting.