tutor-buddy-pro

AI tutor that guides homework problem-solving with step-by-step Socratic questions, creates personalized study plans, runs quizzes, and adapts to your learni...

This skill appears to do what it says: local tutoring with progress tracking and an optional report renderer. Before installing: 1) Inspect and run the setup commands manually rather than blindly pasting the SETUP-PROMPT; verify the SKILL_DIR value the find command returns to avoid unintended chmod/cp actions. 2) If you won't use reports, you can ignore scripts/generate-progress-report.sh (it requires Playwright to render PNGs). 3) Keep the skill offline if you want to ensure no accidental network sync; the dashboard spec refers to future syncing but no outbound network code is present today. 4) Verify data directory permissions (data/ set to owner-only) and review data/learner-profile.json contents if minors will use the tool. 5) The SKILL.md contains explicit prompt-injection defenses — good — but always be cautious about pasting content from untrusted sources. If you need higher assurance, run the script in an isolated environment first and consider removing dashboard sync hooks until you review or implement authenticated transports.

Type: OpenClaw Skill Name: tutor-buddy-pro Version: 1.0.0 The Tutor Buddy Pro skill bundle is a highly professional and security-conscious educational tool. It features robust prompt injection defenses in SKILL.md, specifically instructing the agent to treat user-provided content as untrusted data. The included shell script (scripts/generate-progress-report.sh) is hardened against common vulnerabilities, utilizing HTML escaping to prevent XSS during report rendering and path normalization to prevent traversal. Furthermore, the bundle includes a detailed SECURITY.md and a CODEX-SECURITY-AUDIT.md that documents the intentional remediation of potential flaws, demonstrating a clear commitment to safety and data privacy.