Security & privacy

Student names and scanned textbook pages never leave your computer.

Two things you can verify yourself

The six skills are 32 Markdown documents with no executable code. Every instruction they contain can be read as plain text.
The skills do not phone home — no URLs, no API calls, no telemetry. You still need the internet to run them, because your agent talks to its model. That traffic is between you and the model provider, not TeachFlow.

Security risk	What we do	How you can check
Prompt injection	Uploaded textbook content is handled as data. It is never executed as instructions.	Read the skill files — every instruction the model follows is in plain Markdown you can review.
Data exfiltration	File reads and writes stay inside the current working directory; output goes to outputs/. Never ~, /etc or /usr.	Search the package for a path outside the working directory. The only matches are the lines that forbid those paths.
Secret detection	No hardcoded credentials. Where a credential is needed, only the environment variable name appears.	Grep the package for keys and tokens — the files are plain text and fully searchable.
Dangerous commands	Only whitelisted tools run: python-pptx, python-docx, openpyxl, soffice/LibreOffice, and headless Chrome for local HTML rendering only.	Every command the skills may run is listed in the skill files themselves.
Obfuscation	No base64 blobs, no escape tricks, no invisible Unicode.	Open any file in the package — all of it is readable prose and structured instructions.
External fetch	The skill files make no network requests of their own: no external URLs, no remote script downloads, no API calls. Your agent still needs the internet to reach its model.	Search the package for URLs and HTTP calls. Nothing is invoked. You will still need the internet, because the agent talks to its model.
Credential access	No reads from the keychain, .ssh, .aws, browser credential stores, or any other credential location.	Search the package for those credential locations — none appear.
Privilege escalation	No sudo, no chmod 777, no rm -rf, no curl \| sh, no eval.	Search the package for these commands. None is ever invoked. Every occurrence sits inside a line that forbids it, except the letters "eval" inside the English words "evaluate" and "Evaluation" in teacher-language word lists.