Generate professional math practice worksheets and full answer keys as PDFs. Compiles LaTeX to PDF using tectonic (free, no account needed). Supports any mat...
Security Analysis
high confidenceThe skill's code, files, and runtime instructions are coherent with its stated purpose (generating LaTeX worksheets, verifying with SymPy, and compiling with tectonic); no unrelated credentials or network installs are requested, though a couple of expected-but-notable behaviors merit attention.
The skill declares and implements a LaTeX-based worksheet generator that verifies answers with SymPy and compiles PDFs with tectonic. Required tools (tectonic, python3, sympy) align with the described functionality and no unrelated credentials or binaries are requested.
Runtime instructions stay within the worksheet workflow (generate problems, produce structured JSON verification, run verify.py, compile .tex with tectonic). Two items to note: (1) the skill suggests using an "image" tool to extract problem info from photos — that uses the platform's image capability but is reasonable for the stated photo shortcut; (2) verify.py uses sympy.sympify and related functions to parse string expressions from the verification JSON — this is expected for mathematical checks but is a parsing/evaluation surface to treat carefully (see environment_proportionality and user guidance).
There is no install spec bundled with the skill (instruction-only), which limits install-time risk. The compile step depends on tectonic, which will auto-download LaTeX packages at compile time — expected for building PDFs but it does imply transient network activity to CTAN or tectonic mirrors when compiling.
The skill requests no environment variables or credentials. The only config access is optional local reading of OpenClaw config files (~/.openclaw/config.json) to detect configured models; the checker extracts model identifiers only, not tokens, which is reasonable for model-detection purposes.
The skill does not request permanent presence (always:false). It includes local scripts and templates but does not modify other skills or system settings. Autonomous invocation is allowed by default (platform normal) but not combined with other high-risk patterns here.
Guidance
This skill is coherent with its stated purpose, but review these practical points before installing: - SymPy evaluation: verify.py uses sympy.sympify/nsimplify to parse expressions from a generated JSON. This is necessary to check math, but sympify is a parsing/evaluation surface — avoid running verification on JSON from untrusted third parties without review. If you accept uploaded verification files, audit the inputs first or run verification in a sandbox. - Tectonic downloads: compiling LaTeX with tectonic may cause the tool to fetch TeX packages from the network on first use. This is expected but means transient network activity when compiling PDFs. - Config reading: check_reasoning_model.sh optionally reads ~/.openclaw/config.json to detect configured models. It extracts model IDs (not tokens) to decide which model to use; if your OpenClaw config contains secrets in unusual fields, consider moving them or running the skill in an environment where that config is benign. - Delivery claims vs implementation: README mentions "channel mirroring" delivery (Telegram, iMessage, email) but the provided scripts do not implement network-based delivery; ensure your deployment/integration handles output delivery securely rather than relying on undocumented behavior. Recommendations: inspect the included scripts locally, ensure python3 + sympy and tectonic are installed from trusted sources, and run the first few worksheet generations in a sandboxed user account to verify behavior and network activity. If you need higher assurance, a quick code review focused on sympify usage and any future changes to network calls is advisable.
Latest Release
v2.0.0
**Major update: worksheet verification now uses structured data files (JSON), improving reliability and security.** - Replaced code-based verification ("verify.py" with explicit Python check calls) with a JSON-based format, interpreted by the bundled script. - Updated documentation to require a JSON verification file describing each problem and its expected answer. - `scripts/verify.py` now parses the JSON verification file and evaluates answers using SymPy—no generated code is executed. - Removed legacy script `scripts/fetch_model_config.sh` as part of verification process cleanup. - README and guides updated to reflect the new workflow for problem verification.
Popular Skills
Published by @trondw on ClawHub
