Scan Report
5 /100
ielts-speaking-coach
IELTS Speaking examiner and tutor skill with audio pronunciation scoring, Part 1/2/3 practice, mock exams, and ZPD learning paths
IELTS Speaking Coach is a clean, documentation-only skill with no executable code. All declared permissions (network for LLM API calls, shell for ffmpeg audio conversion) match actual usage patterns with no hidden functionality.
Safe to install
Approve for deployment. No security concerns identified. The optional backend reference in TESTING.md is localhost-only and documented.
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | NONE | NONE | — | No file read/write operations — uses bundled reference files only |
| Network | READ | READ | ✓ Aligned | LLM API calls for scoring, feedback, model answers — declared in SKILL.md permis… |
| Shell | WRITE | WRITE | ✓ Aligned | ffmpeg audio conversion (16kHz mono WAV) — declared in SKILL.md Audio Analysis s… |
| Environment | NONE | NONE | — | No environment variable access |
| Skill Invoke | NONE | NONE | — | No sub-skill invocation |
| Clipboard | NONE | NONE | — | No clipboard access |
| Browser | NONE | NONE | — | No browser usage |
| Database | NONE | NONE | — | No database access — optional backend is localhost-only |
1 findings
Medium External URL 外部 URL
http://host.docker.internal:8081 TESTING.md:107 File Tree
14 files · 97.1 KB · 2355 lines Markdown 11f · 1983L
JSON 2f · 251L
YAML 1f · 121L
├─
CHANGELOG.md
Markdown
├─
clawhub.json
JSON
├─
cue-cards-2025-may-aug.md
Markdown
├─
cue-cards.md
Markdown
├─
examples.md
Markdown
├─
learning-path.md
Markdown
├─
pronunciation-guide.md
Markdown
├─
PUBLISH.md
Markdown
├─
README.md
Markdown
├─
scoring-rubric.md
Markdown
├─
SKILL.md
Markdown
├─
skill.yaml
YAML
├─
TESTING.md
Markdown
└─
vocab-map.json
JSON
Security Positives
✓ All 14 files are documentation/data (Markdown/JSON/YAML) — no executable code whatsoever
✓ Permissions (network, shell) are accurately declared and match actual use
✓ No .env files, no hardcoded credentials, no API key access
✓ Audio processing via ffmpeg is documented and necessary for pronunciation scoring
✓ The optional backend URL (host.docker.internal:8081) is localhost-only, not an external C2 endpoint
✓ No obfuscation, no base64 payloads, no eval() calls
✓ No supply chain risk — no external dependencies pinned or unpinned
✓ Reference files (scoring-rubric.md, cue-cards.md, vocab-map.json) are static educational content