Security audit
Security checks for vulnerabilities and agentic risk
This is a simple Markdown-only skill with vague system-monitor learning notes and no code, persistence, credential access, or automatic actions.
Before installing, understand that this skill appears to be only a lightweight Chinese-language note template, not a working system monitor. Its trigger terms are broad, so users may want to narrow them to the exact skill name to avoid accidental activation.
The manifest trigger contains ambiguous terms such as 'System' and 'Monitor', which are common words likely to appear in benign user requests unrelated to this skill. This raises the risk of accidental invocation, especially because the trigger mixes a specific name with highly generic keywords.
The trigger scenarios are broad and include generic user utterances like requests for related help, which can cause the skill to activate during ordinary conversation rather than only on explicit invocation. In an agent environment, unintended activation can route user input to the wrong skill, causing confusing behavior or inappropriate access to tool-oriented functionality.
The merged secondary skill repeats the same problem by defining loose trigger phrases, including a phrase derived from video metadata rather than a deliberate invocation command. This broadens the activation surface and increases the chance that unrelated conversations will trigger the skill unexpectedly.
The natural-language description, instructions, and trigger guidance are written in Chinese, but the file does not indicate that the skill is region-specific or that users may choose another language. This can violate language/locale policy when a skill implicitly forces one language without opt-in.
No suspicious patterns detected.
