Security audit
Security checks for vulnerabilities and agentic risk
This is a simple markdown-only skill with broad and somewhat messy triggers, but it does not request sensitive access, run code, persist changes, or handle private data.
Install only if you want this rough video-derived guidance, and expect possible irrelevant activation from broad triggers such as RPG, 新发售, and 中英双语. The main improvement needed is cleanup and narrower trigger wording, not removal for security reasons.
The trigger definition includes broad generic terms such as "agent_builder", "新发售", and "RPG", which are likely to appear in unrelated user conversations. This can cause unintended activation of the skill, leading to incorrect context injection or hijacking of benign requests that merely mention these common terms.
The activation scenario includes a broad condition like users needing "agent_builder相关帮助", which lacks clear boundaries and may match many unrelated help requests. This increases the chance of accidental invocation and can steer the assistant into using irrelevant or unintended skill instructions.
The merged section introduces another set of generic triggers, including the skill name and broad topical phrases, creating additional collision risk. Because this content appears auto-merged from a different source, it also broadens the skill's activation surface in ways that are unrelated to the primary subject matter.
The merged section prominently specifies "中英双语" as part of the skill description, but the file does not indicate that users can choose their preferred language or opt into bilingual output. This may conflict with language/locale policy expectations when a skill implicitly forces a language mode.
