Vietnam Education

Skill soạn giáo án, đề thi, phiếu học tập theo chuẩn Chương trình GDPT 2018 (Thông tư 32/2018/TT-BGDĐT) và Công văn 7991/BGDĐT-GDTrH (cấu trúc đề kiểm tra đị...

This skill appears coherent for composing Vietnamese lesson plans and CV‑7991 exam papers, but check these before installing: - Missing file: SKILL.md references a validate.py step but no validate.py is included; ask the author or verify how the output Word is validated. - Input parsing: draw-figure.py and verify-answer.py use sympy.parse_expr / parse functions on strings. If you (or the agent) pass untrusted text into these, it can be unsafe — run in a sandbox or review/limit inputs before executing. - Installation notes: SKILL.md recommends global npm install -g docx and pip install ... --break-system-packages. Prefer using a virtualenv (python) and avoid global npm installs if possible to reduce system impact. - Web searches: The workflow depends on the agent performing web_search to fetch SGK/textbook content. That means data will be retrieved from the web during operation — consider privacy implications if you will be using proprietary or student data alongside the tool. - Code review: The included JS/Python look free of network calls and external endpoints, but you should still scan the code if you plan to run it in a sensitive environment. If you want to proceed safely: run the scripts in an isolated environment (virtualenv/container), avoid installing packages globally, confirm or obtain the missing validate.py, and review how expressions passed to sympy are constructed or sanitized.

Type: OpenClaw Skill Name: vietnam-education Version: 1.0.0 The skill bundle is designed to assist Vietnamese teachers in creating lesson plans and exams according to national standards (Circular 32/2018 and Dispatch 7991). While the functionality is well-aligned with its stated purpose, the Python scripts `verify-answer.py` and `draw-figure.py` utilize `sympy.parsing.sympy_parser.parse_expr` and `sympify` to process mathematical expressions. These functions are known to be vulnerable to arbitrary code execution (RCE) if they process unsanitized input, which could be exploited via a crafted prompt. Additionally, `SKILL.md` encourages the use of the `--break-system-packages` flag during installation, which is a risky practice on many Linux distributions.