Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Markdown-based helper for managing a local writing and ideas folder, with some broad trigger wording users should keep in mind.
Install this if you want an agent to manage a local my-mind writing workspace. Prefer explicit invocations such as /my-mind-manager or mentioning my-mind, and confirm before it creates directories, moves assets, marks articles as published, or commits repository changes.
The README states that the AI will automatically load the skill whenever the instruction matches the description, but the description covers broad content-management tasks. This ambiguity increases the chance that unrelated requests will trigger the skill, potentially causing unintended file creation, reorganization, or other actions in the user's workspace.
The natural-language triggers are broad phrases like '记录一个灵感' and '帮我写篇文章', which are common user requests and not tightly scoped to this specific skill. In agent environments with automatic skill loading, this can cause unintended activation and execution of filesystem-affecting workflows when the user only intended generic writing help.
The trigger examples include vague phrases like '创作' and '完成写作' without indicating that they apply only to the my-mind skill context. Because these are ordinary requests in many workflows, they can collide with unrelated tasks and cause accidental skill selection in systems that rely on semantic matching.
The trigger phrases and keywords are broad enough to match common, non-specific writing or note-taking requests, which can cause the skill to activate outside the user's intended scope. That increases the chance of the agent taking file-management actions such as creating directories, moving files, or preparing commits in response to ordinary conversation about writing.
The usage section defines activation conditions with ambiguous natural-language cues like '有个想法', '写文章', and '创作', which are routine phrases in normal chat and not safely scoped to this skill. Because the skill can create files, move content, rename outputs, and '提交代码', ambiguous invocation creates a real risk of unintended state-changing operations.
No suspicious patterns detected.
